# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 04.10.2020 16:35:21.239 Process: id = "1" image_name = "buiransomsample.exe" filename = "c:\\users\\fd1hvy\\desktop\\buiransomsample.exe" page_root = "0x7c8e000" os_pid = "0x13d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13d4 [0068.137] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0068.138] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.139] GetProcAddress (hModule=0x74bc0000, lpProcName=0x2ca82c) returned 0x74cb7060 [0068.140] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.140] GetProcAddress (hModule=0x74bc0000, lpProcName="FlsAlloc") returned 0x74cbbea0 [0068.140] GetProcAddress (hModule=0x74bc0000, lpProcName="FlsSetValue") returned 0x74cb2550 [0068.142] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.142] GetProcAddress (hModule=0x74bc0000, lpProcName="InitializeCriticalSectionEx") returned 0x74cb7060 [0068.143] GetProcessHeap () returned 0x310000 [0068.143] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.143] GetProcAddress (hModule=0x74bc0000, lpProcName="FlsAlloc") returned 0x74cbbea0 [0068.143] GetLastError () returned 0xcb [0068.143] GetProcAddress (hModule=0x74bc0000, lpProcName="FlsGetValue") returned 0x74ca70c0 [0068.143] GetProcAddress (hModule=0x74bc0000, lpProcName="FlsSetValue") returned 0x74cb2550 [0068.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x3322e8 [0068.144] SetLastError (dwErrCode=0xcb) [0068.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe00) returned 0x333798 [0068.220] GetStartupInfoW (in: lpStartupInfo=0x10ffa90 | out: lpStartupInfo=0x10ffa90*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0068.220] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0068.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0068.220] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0068.220] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe\" " [0068.220] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe\" " [0068.220] GetACP () returned 0x4e4 [0068.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x220) returned 0x3237c8 [0068.220] IsValidCodePage (CodePage=0x4e4) returned 1 [0068.220] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x10ffab0 | out: lpCPInfo=0x10ffab0) returned 1 [0068.220] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x10ff378 | out: lpCPInfo=0x10ff378) returned 1 [0068.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x10ff118, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0068.220] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpCharType=0x10ff38c | out: lpCharType=0x10ff38c) returned 1 [0068.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x10ff0c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0068.220] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.221] GetProcAddress (hModule=0x74bc0000, lpProcName="LCMapStringEx") returned 0x74c9ed00 [0068.221] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0068.221] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x10feeb8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0068.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x10ff88c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x9dë\x8bÈú\x0f\x01è4+", lpUsedDefaultChar=0x0) returned 256 [0068.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10ff98c, cbMultiByte=256, lpWideCharStr=0x10ff0e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0068.221] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0068.221] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x10feed8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0068.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x10ff78c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x9dë\x8bÈú\x0f\x01è4+", lpUsedDefaultChar=0x0) returned 256 [0068.221] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x324f00 [0068.221] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2fd728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\buiransomsample.exe")) returned 0x2b [0068.221] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x60) returned 0x3239f0 [0068.221] RtlInitializeSListHead (in: ListHead=0x2fd3c0 | out: ListHead=0x2fd3c0) [0068.221] GetLastError () returned 0x0 [0068.222] SetLastError (dwErrCode=0x0) [0068.222] GetEnvironmentStringsW () returned 0x3345a0* [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xaca) returned 0x335078 [0068.222] FreeEnvironmentStringsW (penv=0x3345a0) returned 1 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x94) returned 0x3218f0 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3e) returned 0x321f70 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x50) returned 0x321310 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6e) returned 0x31e708 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x78) returned 0x324190 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x62) returned 0x31e4c8 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x28) returned 0x32aa28 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x48) returned 0x327420 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1a) returned 0x330a68 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2e) returned 0x3229d0 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x56) returned 0x31f130 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2a) returned 0x3228f0 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2e) returned 0x322a78 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x44) returned 0x3276a0 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1c) returned 0x330ae0 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x182) returned 0x320c40 [0068.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7c) returned 0x31e968 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x32d1a8 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3a) returned 0x321ca0 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x90) returned 0x320e50 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x24) returned 0x32aa58 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x30) returned 0x322b20 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x32d228 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x48) returned 0x327790 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x52) returned 0x31e798 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3c) returned 0x322048 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xd6) returned 0x3319f8 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2e) returned 0x3226f8 [0068.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1e) returned 0x330950 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2c) returned 0x322a08 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x50) returned 0x31e558 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4e) returned 0x316c78 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x24) returned 0x32a968 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x42) returned 0x327470 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x20) returned 0x330888 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x38) returned 0x32cde8 [0068.224] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x24) returned 0x32ac08 [0068.224] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x335078 | out: hHeap=0x310000) returned 1 [0068.225] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="FlsAlloc") returned 0x772e4ae0 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="FlsFree") returned 0x772e4b00 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="FlsGetValue") returned 0x772e4b20 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="FlsSetValue") returned 0x772e4b40 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeCriticalSectionEx") returned 0x7733ebc0 [0068.225] GetProcAddress (hModule=0x772d0000, lpProcName="InitOnceExecuteOnce") returned 0x74cb5550 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="CreateEventExW") returned 0x7733eb20 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="CreateSemaphoreW") returned 0x7733eb90 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="CreateSemaphoreExW") returned 0x7733eb80 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThreadpoolTimer") returned 0x772e6d30 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadpoolTimer") returned 0x779bd7c0 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x779bb840 [0068.226] GetProcAddress (hModule=0x772d0000, lpProcName="CloseThreadpoolTimer") returned 0x779bb740 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThreadpoolWait") returned 0x772e6d70 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadpoolWait") returned 0x779bc0b0 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="CloseThreadpoolWait") returned 0x779bbe10 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="FlushProcessWriteBuffers") returned 0x779e2b20 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x779d8e50 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcessorNumber") returned 0x779d52f0 [0068.227] GetProcAddress (hModule=0x772d0000, lpProcName="CreateSymbolicLinkW") returned 0x772e4510 [0068.228] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentPackageId") returned 0x74cbe260 [0068.228] GetProcAddress (hModule=0x772d0000, lpProcName="GetTickCount64") returned 0x772e0db0 [0068.228] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileInformationByHandleEx") returned 0x772e43d0 [0068.228] GetProcAddress (hModule=0x772d0000, lpProcName="SetFileInformationByHandle") returned 0x7733f110 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x7733f1e0 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeConditionVariable") returned 0x779d3a00 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="WakeConditionVariable") returned 0x77a48c50 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="WakeAllConditionVariable") returned 0x779d8a90 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="SleepConditionVariableCS") returned 0x74d2fca0 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeSRWLock") returned 0x779d3a00 [0068.229] GetProcAddress (hModule=0x772d0000, lpProcName="AcquireSRWLockExclusive") returned 0x779b58e0 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77a32ce0 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="ReleaseSRWLockExclusive") returned 0x779b83a0 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="SleepConditionVariableSRW") returned 0x74d2fcf0 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThreadpoolWork") returned 0x772e6db0 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="SubmitThreadpoolWork") returned 0x779beb00 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="CloseThreadpoolWork") returned 0x779bed50 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringEx") returned 0x772e7050 [0068.230] GetProcAddress (hModule=0x772d0000, lpProcName="GetLocaleInfoEx") returned 0x772e7190 [0068.231] GetProcAddress (hModule=0x772d0000, lpProcName="LCMapStringEx") returned 0x772e7480 [0068.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x800) returned 0x3345a0 [0068.231] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0068.231] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x286dff) returned 0x0 [0068.232] GetCurrentThread () returned 0xfffffffe [0068.232] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x10ffb04, lpExitTime=0x10ffb0c, lpKernelTime=0x10ffb0c, lpUserTime=0x10ffb0c | out: lpCreationTime=0x10ffb04, lpExitTime=0x10ffb0c, lpKernelTime=0x10ffb0c, lpUserTime=0x10ffb0c) returned 1 [0068.232] RtlInitializeSListHead (in: ListHead=0x2fd468 | out: ListHead=0x2fd468) [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x320b30 [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x320b88 [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322538 [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3225e0 [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3309a0 [0068.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3309c8 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330a18 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330a40 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330810 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3306d0 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3305e0 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330630 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330518 [0068.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330388 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x322000 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322b90 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x322438 [0068.234] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324f00) returned 0x80 [0068.234] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324f00, Size=0x100) returned 0x31e080 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3221f8 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x322490 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3220d8 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322730 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x321d78 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x321dc0 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330608 [0068.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330400 [0068.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330680 [0068.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3357c0 [0068.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3355c8 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x324f00 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3356a0 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3356e8 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330450 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3213d0 [0068.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3304a0 [0068.236] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x31e080) returned 0x100 [0068.236] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x31e080, Size=0x200) returned 0x3231b8 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330540 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330658 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x321428 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x324b10 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322768 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322bc8 [0068.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330720 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3306a8 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330798 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330748 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3307c0 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330428 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3304f0 [0068.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330838 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330360 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3304c8 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335658 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322c00 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x324b68 [0068.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3352f8 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x31e2b8 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335268 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3226c0 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335898 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335970 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3303b0 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3306f8 [0068.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330478 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335730 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335ad8 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x31e320 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335928 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335850 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3307e8 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x321b48 [0068.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330770 [0068.243] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3231b8) returned 0x200 [0068.243] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3231b8, Size=0x400) returned 0x3365f8 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3303d8 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330568 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x321ba0 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336ef8 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322c38 [0068.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322ca8 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x330590 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3305b8 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x31aca0 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337288 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337260 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337710 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337350 [0068.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337698 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337648 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3373a0 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335778 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x322c70 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336b30 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3352b0 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x321660 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3354a8 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x31ebb0 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3353d0 [0068.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335538 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337530 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3376c0 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337558 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335a90 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3354f0 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336e48 [0068.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335340 [0068.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335610 [0068.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3374e0 [0068.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336be0 [0068.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3375d0 [0068.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337508 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337418 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336b88 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336c38 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x31ed00 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x31ec20 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337238 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3373f0 [0068.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337440 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337468 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3373c8 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3376e8 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337580 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3372b0 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3372d8 [0068.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337300 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335580 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338178 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x337058 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335808 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3216c8 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3359b8 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338140 [0068.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3358e0 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335418 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3375a8 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3374b8 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337490 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335388 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335a00 [0068.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336f50 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335460 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335a48 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337328 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336ad8 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3375f8 [0068.252] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3365f8) returned 0x400 [0068.252] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3365f8, Size=0x800) returned 0x338218 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337620 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337378 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3370b0 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336fa8 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3381b0 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3380d0 [0068.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337670 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3377d8 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337878 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3378a0 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337800 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337738 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337940 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337760 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3379e0 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337850 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335220 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338108 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336d40 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335bb0 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x316df8 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335fa0 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337a40 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335b68 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3360c0 [0068.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337788 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337828 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3378c8 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x336108 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335b20 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336c90 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x336078 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335c40 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3378f0 [0068.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336d98 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3377b0 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337918 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337968 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x337108 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336a80 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337b20 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337dc0 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x337990 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3379b8 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338e10 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338dc0 [0068.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338de8 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338d48 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338b68 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338cd0 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338d70 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338e38 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335e38 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337a78 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x337000 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335f58 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x316e60 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335e80 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337bc8 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335bf8 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335da8 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338b90 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338e88 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338b18 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335c88 [0068.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x336030 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x337160 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335cd0 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x335ec8 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338d98 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336ce8 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338a50 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338e60 [0068.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c08 [0068.257] GetStartupInfoW (in: lpStartupInfo=0x10ffaf4 | out: lpStartupInfo=0x10ffaf4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0068.257] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x772d0000 [0068.257] GetProcAddress (hModule=0x772d0000, lpProcName="AreFileApisANSI") returned 0x772e4280 [0068.257] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.258] GetProcAddress (hModule=0x74bc0000, lpProcName="CompareStringEx") returned 0x74c82c20 [0068.258] GetProcAddress (hModule=0x74bc0000, lpProcName="EnumSystemLocalesEx") returned 0x74c83a60 [0068.258] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.258] GetProcAddress (hModule=0x74bc0000, lpProcName="GetDateFormatEx") returned 0x74cf9b40 [0068.258] GetProcAddress (hModule=0x74bc0000, lpProcName="GetLocaleInfoEx") returned 0x74caf170 [0068.258] GetProcAddress (hModule=0x74bc0000, lpProcName="GetTimeFormatEx") returned 0x74cf9e10 [0068.259] GetProcAddress (hModule=0x74bc0000, lpProcName="GetUserDefaultLocaleName") returned 0x74cb4220 [0068.259] GetProcAddress (hModule=0x74bc0000, lpProcName="IsValidLocaleName") returned 0x74caed60 [0068.259] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.259] GetProcAddress (hModule=0x74bc0000, lpProcName="LCIDToLocaleName") returned 0x74cada50 [0068.259] GetProcAddress (hModule=0x74bc0000, lpProcName="LocaleNameToLCID") returned 0x74c8bac0 [0068.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x32c818 [0068.259] GetLastError () returned 0x0 [0068.259] SetLastError (dwErrCode=0x0) [0068.259] GetLastError () returned 0x0 [0068.259] SetLastError (dwErrCode=0x0) [0068.260] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8) returned 0x321a00 [0068.260] GetLastError () returned 0x0 [0068.260] SetLastError (dwErrCode=0x0) [0068.260] GetLastError () returned 0x0 [0068.260] SetLastError (dwErrCode=0x0) [0068.260] GetUserDefaultLocaleName (in: lpLocaleName=0x10ff3d0, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0068.261] GetACP () returned 0x4e4 [0068.261] IsValidCodePage (CodePage=0x4e4) returned 1 [0068.261] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1001, lpLCData=0x10ff4ec, cchData=64 | out: lpLCData="English") returned 8 [0068.262] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1002, lpLCData=0x10ff56c, cchData=64 | out: lpLCData="United States") returned 14 [0068.262] GetLastError () returned 0x0 [0068.262] SetLastError (dwErrCode=0x0) [0068.262] GetLastError () returned 0x0 [0068.262] SetLastError (dwErrCode=0x0) [0068.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3a) returned 0x335d18 [0068.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x332090 [0068.262] GetLastError () returned 0x0 [0068.262] SetLastError (dwErrCode=0x0) [0068.262] GetLastError () returned 0x0 [0068.262] SetLastError (dwErrCode=0x0) [0068.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3a) returned 0x335d60 [0068.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x332198 [0068.262] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2d07e0, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0068.262] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2d07e0, cbMultiByte=127, lpWideCharStr=0x10ff288, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f") returned 127 [0068.262] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f", cchSrc=127, lpCharType=0x10ff4bc | out: lpCharType=0x10ff4bc) returned 1 [0068.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x32c838 [0068.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x300) returned 0x3365f8 [0068.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x180) returned 0x31f2a8 [0068.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x180) returned 0x3231b8 [0068.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x101) returned 0x321790 [0068.263] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x10ff3b4 | out: lpCPInfo=0x10ff3b4) returned 1 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321791, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321791, cbMultiByte=255, lpWideCharStr=0x10ff0e8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0068.263] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0068.263] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x10feed8, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0068.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchWideChar=255, lpMultiByteStr=0x31f329, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿW¨\x94\x99í«", lpUsedDefaultChar=0x0) returned 255 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321791, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321791, cbMultiByte=255, lpWideCharStr=0x10ff0e8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0068.263] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0068.263] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x10feed8, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ") returned 255 [0068.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ", cchWideChar=255, lpMultiByteStr=0x323239, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fM¨\x94\x83í«", lpUsedDefaultChar=0x0) returned 255 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321790, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x321790, cbMultiByte=256, lpWideCharStr=0x10ff118, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0068.263] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x3366f8 | out: lpCharType=0x3366f8) returned 1 [0068.263] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321790 | out: hHeap=0x310000) returned 1 [0068.263] GetLastError () returned 0x0 [0068.263] SetLastError (dwErrCode=0x0) [0068.264] GetLastError () returned 0x0 [0068.264] SetLastError (dwErrCode=0x0) [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3a) returned 0x335fe8 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3320f0 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x50) returned 0x336df0 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x32c708 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x32c6e8 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x10ff2a8, cchData=4 | out: lpLCData="USD") returned 4 [0068.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USD", cchWideChar=-1, lpMultiByteStr=0x10ff308, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USD", lpUsedDefaultChar=0x0) returned 4 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x32c878 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x10ff298, cchData=2 | out: lpLCData="$") returned 2 [0068.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=-1, lpMultiByteStr=0x10ff2f4, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 2 [0068.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x32c898 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.264] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x10ff278, cchData=2 | out: lpLCData=".") returned 2 [0068.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x10ff2e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0068.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x32c6c8 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x10ff268, cchData=2 | out: lpLCData=",") returned 2 [0068.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x10ff2cc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0068.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339478 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x18, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x18, lpLCData=0x10ff2a8, cchData=4 | out: lpLCData="3;0") returned 4 [0068.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x10ff308, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0068.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339508 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x10ff298, cchData=1 | out: lpLCData="") returned 1 [0068.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x10ff2f4, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0068.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1) returned 0x3395e8 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x10ff278, cchData=2 | out: lpLCData="-") returned 2 [0068.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=-1, lpMultiByteStr=0x10ff2e0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-", lpUsedDefaultChar=0x0) returned 2 [0068.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339608 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2000001a, lpLCData=0x10ff2c8, cchData=2 | out: lpLCData="\x02") returned 2 [0068.265] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000019, lpLCData=0x10ff304, cchData=2 | out: lpLCData="\x02") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000054, lpLCData=0x10ff2f0, cchData=2 | out: lpLCData="\x01") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000055, lpLCData=0x10ff2dc, cchData=2 | out: lpLCData="") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000056, lpLCData=0x10ff2c8, cchData=2 | out: lpLCData="\x01") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000057, lpLCData=0x10ff304, cchData=2 | out: lpLCData="") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000052, lpLCData=0x10ff2f0, cchData=2 | out: lpLCData="\x03") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000053, lpLCData=0x10ff2dc, cchData=2 | out: lpLCData="") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339618 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x339618, cchData=4 | out: lpLCData="USD") returned 4 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339458 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x339458, cchData=2 | out: lpLCData="$") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339498 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x339498, cchData=2 | out: lpLCData=".") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339518 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x339518, cchData=2 | out: lpLCData=",") returned 2 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339598 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x339598, cchData=1 | out: lpLCData="") returned 1 [0068.266] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339578 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x339578, cchData=2 | out: lpLCData="-") returned 2 [0068.267] GetLastError () returned 0x0 [0068.267] SetLastError (dwErrCode=0x0) [0068.267] GetLastError () returned 0x0 [0068.267] SetLastError (dwErrCode=0x0) [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3a) returned 0x335f10 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3322a0 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x50) returned 0x336a28 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4) returned 0x3395b8 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4) returned 0x3394f8 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x10ff2a8, cchData=2 | out: lpLCData=".") returned 2 [0068.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x10ff30c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339468 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x10ff298, cchData=2 | out: lpLCData=",") returned 2 [0068.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x10ff2f8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x3394d8 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x10, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x10, lpLCData=0x10ff278, cchData=4 | out: lpLCData="3;0") returned 4 [0068.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x10ff2e4, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3395d8 [0068.267] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339568 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x339568, cchData=2 | out: lpLCData=".") returned 2 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339488 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x339488, cchData=2 | out: lpLCData=",") returned 2 [0068.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c708 | out: hHeap=0x310000) returned 1 [0068.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x336df0 | out: hHeap=0x310000) returned 1 [0068.268] GetLastError () returned 0x0 [0068.268] SetLastError (dwErrCode=0x0) [0068.268] GetLastError () returned 0x0 [0068.268] SetLastError (dwErrCode=0x0) [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3a) returned 0x336150 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x332240 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x164) returned 0x330f40 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x332228 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Mon") returned 4 [0068.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 4 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339558 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x10ff268, cchData=7 | out: lpLCData="Monday") returned 7 [0068.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 7 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7) returned 0x3394b8 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339588 [0068.268] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x339588, cchData=4 | out: lpLCData="Mon") returned 4 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x332210 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x332210, cchData=7 | out: lpLCData="Monday") returned 7 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Tue") returned 4 [0068.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 4 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3394a8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x10ff268, cchData=8 | out: lpLCData="Tuesday") returned 8 [0068.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 8 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3395a8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3394c8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x3394c8, cchData=4 | out: lpLCData="Tue") returned 4 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x332258 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x332258, cchData=8 | out: lpLCData="Tuesday") returned 8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Wed") returned 4 [0068.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 4 [0068.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3394e8 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0068.269] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x10ff268, cchData=10 | out: lpLCData="Wednesday") returned 10 [0068.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 10 [0068.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x3322b8 [0068.270] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3395c8 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x3395c8, cchData=4 | out: lpLCData="Wed") returned 4 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0068.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a440 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x32a440, cchData=10 | out: lpLCData="Wednesday") returned 10 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Thu") returned 4 [0068.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 4 [0068.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339528 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x10ff268, cchData=9 | out: lpLCData="Thursday") returned 9 [0068.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 9 [0068.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x332270 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339538 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x339538, cchData=4 | out: lpLCData="Thu") returned 4 [0068.398] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a600 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x32a600, cchData=9 | out: lpLCData="Thursday") returned 9 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Fri") returned 4 [0068.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 4 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3395f8 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x10ff268, cchData=7 | out: lpLCData="Friday") returned 7 [0068.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 7 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7) returned 0x339548 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339298 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x339298, cchData=4 | out: lpLCData="Fri") returned 4 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x332288 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x332288, cchData=7 | out: lpLCData="Friday") returned 7 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Sat") returned 4 [0068.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 4 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339378 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.399] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x10ff268, cchData=9 | out: lpLCData="Saturday") returned 9 [0068.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 9 [0068.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x3322d0 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3392d8 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x3392d8, cchData=4 | out: lpLCData="Sat") returned 4 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a4e0 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x32a4e0, cchData=9 | out: lpLCData="Saturday") returned 9 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Sun") returned 4 [0068.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339388 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x10ff268, cchData=7 | out: lpLCData="Sunday") returned 7 [0068.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 7 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7) returned 0x3393e8 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339288 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x339288, cchData=4 | out: lpLCData="Sun") returned 4 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x339e10 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x339e10, cchData=7 | out: lpLCData="Sunday") returned 7 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.400] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Jan") returned 4 [0068.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 4 [0068.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339268 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x10ff268, cchData=8 | out: lpLCData="January") returned 8 [0068.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="January", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 8 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339328 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339358 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x339358, cchData=4 | out: lpLCData="Jan") returned 4 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x339d38 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x339d38, cchData=8 | out: lpLCData="January") returned 8 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Feb") returned 4 [0068.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 4 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3392b8 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x10ff268, cchData=9 | out: lpLCData="February") returned 9 [0068.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="February", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 9 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x339cd8 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339308 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x339308, cchData=4 | out: lpLCData="Feb") returned 4 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a620 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x32a620, cchData=9 | out: lpLCData="February") returned 9 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.401] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Mar") returned 4 [0068.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 4 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3392e8 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x10ff278, cchData=6 | out: lpLCData="March") returned 6 [0068.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="March", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 6 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6) returned 0x339438 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3393d8 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x3393d8, cchData=4 | out: lpLCData="Mar") returned 4 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x339d50 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x339d50, cchData=6 | out: lpLCData="March") returned 6 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Apr") returned 4 [0068.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 4 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339408 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x10ff278, cchData=6 | out: lpLCData="April") returned 6 [0068.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="April", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 6 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6) returned 0x3393f8 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339418 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x339418, cchData=4 | out: lpLCData="Apr") returned 4 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0068.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x339c90 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x339c90, cchData=6 | out: lpLCData="April") returned 6 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.402] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x10ff288, cchData=4 | out: lpLCData="May") returned 4 [0068.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3392f8 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x10ff278, cchData=4 | out: lpLCData="May") returned 4 [0068.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339448 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339258 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x339258, cchData=4 | out: lpLCData="May") returned 4 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339318 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x339318, cchData=4 | out: lpLCData="May") returned 4 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Jun") returned 4 [0068.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339348 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x10ff278, cchData=5 | out: lpLCData="June") returned 5 [0068.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="June", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 5 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5) returned 0x3393c8 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3392a8 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x3392a8, cchData=4 | out: lpLCData="Jun") returned 4 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0068.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x339c78 [0068.403] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x339c78, cchData=5 | out: lpLCData="June") returned 5 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Jul") returned 4 [0068.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 4 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339368 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x10ff278, cchData=5 | out: lpLCData="July") returned 5 [0068.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="July", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 5 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5) returned 0x339428 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339278 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x339278, cchData=4 | out: lpLCData="Jul") returned 4 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x339c60 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x339c60, cchData=5 | out: lpLCData="July") returned 5 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Aug") returned 4 [0068.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 4 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339398 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x10ff268, cchData=7 | out: lpLCData="August") returned 7 [0068.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="August", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 7 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7) returned 0x3392c8 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3393a8 [0068.404] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x3393a8, cchData=4 | out: lpLCData="Aug") returned 4 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x339ca8 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x339ca8, cchData=7 | out: lpLCData="August") returned 7 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Sep") returned 4 [0068.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 4 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339338 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x10ff268, cchData=10 | out: lpLCData="September") returned 10 [0068.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="September", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 10 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x339d98 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3393b8 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x3393b8, cchData=4 | out: lpLCData="Sep") returned 4 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a460 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x32a460, cchData=10 | out: lpLCData="September") returned 10 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Oct") returned 4 [0068.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 4 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x32c708 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.405] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x10ff268, cchData=8 | out: lpLCData="October") returned 8 [0068.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="October", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 8 [0068.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339fb8 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x33a018 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x33a018, cchData=4 | out: lpLCData="Oct") returned 4 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0068.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x339de0 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x339de0, cchData=8 | out: lpLCData="October") returned 8 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Nov") returned 4 [0068.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 4 [0068.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339f88 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x10ff268, cchData=9 | out: lpLCData="November") returned 9 [0068.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="November", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 9 [0068.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x339d68 [0068.406] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339fd8 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x339fd8, cchData=4 | out: lpLCData="Nov") returned 4 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a480 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x32a480, cchData=9 | out: lpLCData="November") returned 9 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x10ff288, cchData=4 | out: lpLCData="Dec") returned 4 [0068.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 4 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339f68 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x10ff268, cchData=9 | out: lpLCData="December") returned 9 [0068.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="December", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 9 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x339d80 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x339e88 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x339e88, cchData=4 | out: lpLCData="Dec") returned 4 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a3e0 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x32a3e0, cchData=9 | out: lpLCData="December") returned 9 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x10ff288, cchData=3 | out: lpLCData="AM") returned 3 [0068.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 3 [0068.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3) returned 0x33a058 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0068.407] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x10ff278, cchData=3 | out: lpLCData="PM") returned 3 [0068.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 3 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3) returned 0x339ed8 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6) returned 0x33a028 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x33a028, cchData=3 | out: lpLCData="AM") returned 3 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6) returned 0x33a008 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x33a008, cchData=3 | out: lpLCData="PM") returned 3 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x10ff278, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0068.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=-1, lpMultiByteStr=0x10ff2f0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 9 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x9) returned 0x339db0 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 19 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x10ff258, cchData=19 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0068.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=-1, lpMultiByteStr=0x10ff2dc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM d, yyyy", lpUsedDefaultChar=0x0) returned 19 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x13) returned 0x32a6a0 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x10ff258, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0068.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h:mm:ss tt", cchWideChar=-1, lpMultiByteStr=0x10ff2c8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h:mm:ss tt", lpUsedDefaultChar=0x0) returned 11 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb) returned 0x339dc8 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20001009, lpLCData=0x10ff2b0, cchData=2 | out: lpLCData="\x01") returned 2 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0068.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x32a540 [0068.408] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x32a540, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0068.409] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 19 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x26) returned 0x32aab8 [0068.409] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x32aab8, cchData=19 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0068.409] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x16) returned 0x32a5c0 [0068.409] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x32a5c0, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a6) returned 0x33a240 [0068.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a240 | out: hHeap=0x310000) returned 1 [0068.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c818 | out: hHeap=0x310000) returned 1 [0068.409] GetLastError () returned 0x0 [0068.409] SetLastError (dwErrCode=0x0) [0068.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff970 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x10ff970) returned 27 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1f) returned 0x338d20 [0068.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x338d24, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff970 | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x10ff970) returned 27 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338b40 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2) returned 0x339f18 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338eb0 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2) returned 0x33a038 [0068.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a038 | out: hHeap=0x310000) returned 1 [0068.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2) returned 0x339fa8 [0068.410] GetLastError () returned 0x0 [0068.410] SetLastError (dwErrCode=0x0) [0068.410] GetLastError () returned 0x0 [0068.410] SetLastError (dwErrCode=0x0) [0068.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8) returned 0x336900 [0068.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a6) returned 0x33a240 [0068.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a240 | out: hHeap=0x310000) returned 1 [0068.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338d20 | out: hHeap=0x310000) returned 1 [0068.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321a00 | out: hHeap=0x310000) returned 1 [0068.410] GetLastError () returned 0x0 [0068.410] SetLastError (dwErrCode=0x0) [0068.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8ec | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x10ff8ec) returned 27 [0068.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1f) returned 0x338f00 [0068.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x338f04, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8ec | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x10ff8ec) returned 27 [0068.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1b) returned 0x338bb8 [0068.411] GetLastError () returned 0x0 [0068.411] SetLastError (dwErrCode=0x0) [0068.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ffaf8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0068.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339f98 [0068.411] GetLastError () returned 0x0 [0068.411] SetLastError (dwErrCode=0x0) [0068.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ffaf8, cbMultiByte=-1, lpWideCharStr=0x339f98, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0068.411] GetLastError () returned 0x0 [0068.412] SetLastError (dwErrCode=0x0) [0068.412] GetLastError () returned 0x0 [0068.412] SetLastError (dwErrCode=0x0) [0068.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8) returned 0x321a00 [0068.412] GetLastError () returned 0x0 [0068.412] SetLastError (dwErrCode=0x0) [0068.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a6) returned 0x33a240 [0068.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a240 | out: hHeap=0x310000) returned 1 [0068.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f00 | out: hHeap=0x310000) returned 1 [0068.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x336900 | out: hHeap=0x310000) returned 1 [0068.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339f98 | out: hHeap=0x310000) returned 1 [0068.412] GetLastError () returned 0x0 [0068.412] SetLastError (dwErrCode=0x0) [0068.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8cc | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x10ff8cc) returned 27 [0068.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1f) returned 0x338ac8 [0068.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x338acc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8cc | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x10ff8cc) returned 27 [0068.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1b) returned 0x338c80 [0068.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a6c0 [0068.412] GetLastError () returned 0x0 [0068.412] SetLastError (dwErrCode=0x0) [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x200) returned 0x33a240 [0068.413] GetLastError () returned 0x0 [0068.413] SetLastError (dwErrCode=0x0) [0068.413] GetLastError () returned 0x0 [0068.413] SetLastError (dwErrCode=0x0) [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x339df8 [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x336900 [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339fe8 [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f98 [0068.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a640 [0068.413] GetLastError () returned 0x0 [0068.413] SetLastError (dwErrCode=0x0) [0068.413] GetLastError () returned 0x0 [0068.413] SetLastError (dwErrCode=0x0) [0068.413] GetLastError () returned 0x0 [0068.413] SetLastError (dwErrCode=0x0) [0068.413] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339eb8 [0068.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6) returned 0x339ee8 [0068.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5) returned 0x339e98 [0068.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f78 [0068.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x10) returned 0x339cc0 [0068.414] GetLastError () returned 0x0 [0068.414] SetLastError (dwErrCode=0x0) [0068.415] GetLastError () returned 0x0 [0068.415] SetLastError (dwErrCode=0x0) [0068.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x339cf0 [0068.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f28 [0068.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f38 [0068.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f08 [0068.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x323340 [0068.415] GetLastError () returned 0x0 [0068.415] SetLastError (dwErrCode=0x0) [0068.415] GetLastError () returned 0x0 [0068.415] SetLastError (dwErrCode=0x0) [0068.415] GetLastError () returned 0x0 [0068.415] SetLastError (dwErrCode=0x0) [0068.415] GetLastError () returned 0x0 [0068.416] SetLastError (dwErrCode=0x0) [0068.416] GetLastError () returned 0x0 [0068.416] SetLastError (dwErrCode=0x0) [0068.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a038 [0068.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339fc8 [0068.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1) returned 0x339e68 [0068.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339e78 [0068.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x31e080 [0068.416] GetLastError () returned 0x0 [0068.416] SetLastError (dwErrCode=0x0) [0068.416] GetLastError () returned 0x0 [0068.416] SetLastError (dwErrCode=0x0) [0068.416] GetLastError () returned 0x0 [0068.416] SetLastError (dwErrCode=0x0) [0068.416] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339ff8 [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x339f48 [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1) returned 0x33a048 [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339ea8 [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x327380 [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] GetLastError () returned 0x0 [0068.418] SetLastError (dwErrCode=0x0) [0068.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x56) returned 0x31e0e0 [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x56) returned 0x321790 [0068.419] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31e0e0 | out: hHeap=0x310000) returned 1 [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x56) returned 0x31e0e0 [0068.419] GetLastError () returned 0x0 [0068.419] SetLastError (dwErrCode=0x0) [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x87) returned 0x3217f0 [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x87) returned 0x33a500 [0068.419] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3217f0 | out: hHeap=0x310000) returned 1 [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x87) returned 0x33a8f0 [0068.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xd) returned 0x339d08 [0068.419] GetLastError () returned 0x0 [0068.419] SetLastError (dwErrCode=0x0) [0068.420] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x22, lpLCData=0x10ff90c, cchData=2 | out: lpLCData="0") returned 2 [0068.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x339d20 [0068.420] GetLastError () returned 0x0 [0068.420] SetLastError (dwErrCode=0x0) [0068.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x488) returned 0x33b450 [0068.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x327510 [0068.420] GetLastError () returned 0x0 [0068.420] SetLastError (dwErrCode=0x0) [0068.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x200) returned 0x33b8e0 [0068.420] GetLastError () returned 0x0 [0068.420] SetLastError (dwErrCode=0x0) [0068.420] GetLastError () returned 0x0 [0068.420] SetLastError (dwErrCode=0x0) [0068.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3397e0 [0068.420] GetLastError () returned 0x0 [0068.420] SetLastError (dwErrCode=0x0) [0068.420] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339f58 [0068.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x339ec8 [0068.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a6e0 [0068.421] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] GetLastError () returned 0x0 [0068.421] SetLastError (dwErrCode=0x0) [0068.421] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] GetLastError () returned 0x0 [0068.422] SetLastError (dwErrCode=0x0) [0068.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x339ef8 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be0, cbMultiByte=1, lpWideCharStr=0x10ff8ac, cchWideChar=1 | out: lpWideCharStr="f3縷ď꾻'鯠,") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be1, cbMultiByte=1, lpWideCharStr=0x10ff8ac, cchWideChar=1 | out: lpWideCharStr="a3縷ď꾻'鯠,") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be2, cbMultiByte=1, lpWideCharStr=0x10ff8ac, cchWideChar=1 | out: lpWideCharStr="l3縷ď꾻'鯠,") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be3, cbMultiByte=1, lpWideCharStr=0x10ff8ac, cchWideChar=1 | out: lpWideCharStr="s3縷ď꾻'鯠,") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be4, cbMultiByte=1, lpWideCharStr=0x10ff8ac, cchWideChar=1 | out: lpWideCharStr="e3縷ď꾻'鯠,") returned 1 [0068.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x3396c0 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be0, cbMultiByte=1, lpWideCharStr=0x3396c0, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be1, cbMultiByte=1, lpWideCharStr=0x3396c2, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be2, cbMultiByte=1, lpWideCharStr=0x3396c4, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be3, cbMultiByte=1, lpWideCharStr=0x3396c6, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be4, cbMultiByte=1, lpWideCharStr=0x3396c8, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be8, cbMultiByte=1, lpWideCharStr=0x10ff8a0, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be9, cbMultiByte=1, lpWideCharStr=0x10ff8a0, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9bea, cbMultiByte=1, lpWideCharStr=0x10ff8a0, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9beb, cbMultiByte=1, lpWideCharStr=0x10ff8a0, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x339798 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be8, cbMultiByte=1, lpWideCharStr=0x339798, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be9, cbMultiByte=1, lpWideCharStr=0x33979a, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9bea, cbMultiByte=1, lpWideCharStr=0x33979c, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9beb, cbMultiByte=1, lpWideCharStr=0x33979e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x10) returned 0x3396f0 [0068.423] GetLastError () returned 0x0 [0068.423] SetLastError (dwErrCode=0x0) [0068.423] GetLastError () returned 0x0 [0068.423] SetLastError (dwErrCode=0x0) [0068.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3396a8 [0068.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a1b8 [0068.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a1d8 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a1f8 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x3217f0 [0068.424] GetLastError () returned 0x0 [0068.424] SetLastError (dwErrCode=0x0) [0068.424] GetLastError () returned 0x0 [0068.424] SetLastError (dwErrCode=0x0) [0068.424] GetLastError () returned 0x0 [0068.424] SetLastError (dwErrCode=0x0) [0068.424] GetLastError () returned 0x0 [0068.424] SetLastError (dwErrCode=0x0) [0068.424] GetLastError () returned 0x0 [0068.424] SetLastError (dwErrCode=0x0) [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a1e8 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a1c8 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a208 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a218 [0068.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x3214f8 [0068.424] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a158 [0068.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x33a0d8 [0068.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a138 [0068.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a168 [0068.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x327240 [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.425] SetLastError (dwErrCode=0x0) [0068.425] GetLastError () returned 0x0 [0068.426] SetLastError (dwErrCode=0x0) [0068.426] GetLastError () returned 0x0 [0068.426] SetLastError (dwErrCode=0x0) [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xac) returned 0x321558 [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xac) returned 0x31f7a0 [0068.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321558 | out: hHeap=0x310000) returned 1 [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xac) returned 0x321558 [0068.426] GetLastError () returned 0x0 [0068.426] SetLastError (dwErrCode=0x0) [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x10e) returned 0x31f580 [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x10e) returned 0x332658 [0068.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f580 | out: hHeap=0x310000) returned 1 [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10e) returned 0x31f580 [0068.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1a) returned 0x338a78 [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.427] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x22, lpLCData=0x10ff8f8, cchData=2 | out: lpLCData="0") returned 2 [0068.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x339870 [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x488) returned 0x33bae8 [0068.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x34) returned 0x32cf28 [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.427] GetLastError () returned 0x0 [0068.427] SetLastError (dwErrCode=0x0) [0068.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3276f0 [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x200) returned 0x33bf78 [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x339738 [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] GetLastError () returned 0x0 [0068.428] SetLastError (dwErrCode=0x0) [0068.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a228 [0068.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a068 [0068.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a700 [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] GetLastError () returned 0x0 [0068.429] SetLastError (dwErrCode=0x0) [0068.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a098 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be0, cbMultiByte=1, lpWideCharStr=0x10ff89c, cchWideChar=1 | out: lpWideCharStr="f3鹿ď껤'鯠,") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be1, cbMultiByte=1, lpWideCharStr=0x10ff89c, cchWideChar=1 | out: lpWideCharStr="a3鹿ď껤'鯠,") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be2, cbMultiByte=1, lpWideCharStr=0x10ff89c, cchWideChar=1 | out: lpWideCharStr="l3鹿ď껤'鯠,") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be3, cbMultiByte=1, lpWideCharStr=0x10ff89c, cchWideChar=1 | out: lpWideCharStr="s3鹿ď껤'鯠,") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be4, cbMultiByte=1, lpWideCharStr=0x10ff89c, cchWideChar=1 | out: lpWideCharStr="e3鹿ď껤'鯠,") returned 1 [0068.430] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x339888 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be0, cbMultiByte=1, lpWideCharStr=0x339888, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be1, cbMultiByte=1, lpWideCharStr=0x33988a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be2, cbMultiByte=1, lpWideCharStr=0x33988c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be3, cbMultiByte=1, lpWideCharStr=0x33988e, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be4, cbMultiByte=1, lpWideCharStr=0x339890, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be8, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be9, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9bea, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9beb, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.430] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x339660 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be8, cbMultiByte=1, lpWideCharStr=0x339660, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9be9, cbMultiByte=1, lpWideCharStr=0x339662, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9bea, cbMultiByte=1, lpWideCharStr=0x339664, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2c9beb, cbMultiByte=1, lpWideCharStr=0x339666, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff83c, cbMultiByte=1, lpWideCharStr=0x10ff830, cchWideChar=1 | out: lpWideCharStr=".,ď㱽'.") returned 1 [0068.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff830, cbMultiByte=1, lpWideCharStr=0x10ff824, cchWideChar=1 | out: lpWideCharStr=",ďď㲓',") returned 1 [0068.430] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x10) returned 0x339678 [0068.431] GetLastError () returned 0x0 [0068.431] SetLastError (dwErrCode=0x0) [0068.431] GetLastError () returned 0x0 [0068.431] SetLastError (dwErrCode=0x0) [0068.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3398e8 [0068.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a078 [0068.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a0e8 [0068.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x33a0a8 [0068.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x31f858 [0068.431] GetLastError () returned 0x0 [0068.431] SetLastError (dwErrCode=0x0) [0068.431] GetLastError () returned 0x0 [0068.431] SetLastError (dwErrCode=0x0) [0068.431] GetLastError () returned 0x0 [0068.432] SetLastError (dwErrCode=0x0) [0068.432] GetLastError () returned 0x0 [0068.432] SetLastError (dwErrCode=0x0) [0068.432] GetLastError () returned 0x0 [0068.432] SetLastError (dwErrCode=0x0) [0068.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a088 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c898, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a0b8 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c898, cbMultiByte=1, lpWideCharStr=0x33a0b8, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a148 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339608, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a0c8 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339608, cbMultiByte=1, lpWideCharStr=0x33a0c8, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff8c0, cbMultiByte=1, lpWideCharStr=0x10ff8b4, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0068.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff8b4, cbMultiByte=1, lpWideCharStr=0x10ff8a8, cchWideChar=1 | out: lpWideCharStr=",1ď㰻',") returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x58) returned 0x31f9b0 [0068.432] GetLastError () returned 0x0 [0068.432] SetLastError (dwErrCode=0x0) [0068.432] GetLastError () returned 0x0 [0068.432] SetLastError (dwErrCode=0x0) [0068.432] GetLastError () returned 0x0 [0068.433] SetLastError (dwErrCode=0x0) [0068.433] GetLastError () returned 0x0 [0068.433] SetLastError (dwErrCode=0x0) [0068.433] GetLastError () returned 0x0 [0068.433] SetLastError (dwErrCode=0x0) [0068.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a108 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c878, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="U") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c879, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c87a, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0068.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x33a0f8 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c878, cbMultiByte=1, lpWideCharStr=0x33a0f8, cchWideChar=1 | out: lpWideCharStr="U") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c879, cbMultiByte=1, lpWideCharStr=0x33a0fa, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32c87a, cbMultiByte=1, lpWideCharStr=0x33a0fc, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0068.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a118 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339608, cbMultiByte=1, lpWideCharStr=0x10ff8c0, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0068.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x33a178 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339608, cbMultiByte=1, lpWideCharStr=0x33a178, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff8c0, cbMultiByte=1, lpWideCharStr=0x10ff8b4, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0068.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x10ff8b4, cbMultiByte=1, lpWideCharStr=0x10ff8a8, cchWideChar=1 | out: lpWideCharStr=",1ď㰻',") returned 1 [0068.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x327560 [0068.433] GetLastError () returned 0x0 [0068.433] SetLastError (dwErrCode=0x0) [0068.433] GetLastError () returned 0x0 [0068.434] SetLastError (dwErrCode=0x0) [0068.434] GetLastError () returned 0x0 [0068.434] SetLastError (dwErrCode=0x0) [0068.434] GetLastError () returned 0x0 [0068.434] SetLastError (dwErrCode=0x0) [0068.434] GetLastError () returned 0x0 [0068.434] SetLastError (dwErrCode=0x0) [0068.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x56) returned 0x31fa10 [0068.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321790 | out: hHeap=0x310000) returned 1 [0068.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x56) returned 0x321790 [0068.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31fa10 | out: hHeap=0x310000) returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321790, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321791, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="S1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321792, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321793, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321794, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321795, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="S1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321796, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321797, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321798, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321799, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179a, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179b, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179c, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="M1ď㳡'ថ2") returned 1 [0068.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179d, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="o1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179e, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179f, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a0, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="M1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a1, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="o1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a2, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a3, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a4, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a5, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a6, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a7, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="T1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a8, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a9, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217aa, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ab, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="T1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ac, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ad, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ae, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="s1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217af, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b0, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b1, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b2, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b3, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="W1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b4, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b5, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b6, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b7, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="W1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b8, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b9, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ba, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bb, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bc, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="s1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bd, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217be, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bf, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c0, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c1, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="T1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c2, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="h1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c3, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c4, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c5, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="T1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c6, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="h1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c7, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c8, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c9, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="s1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ca, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cb, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cc, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cd, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ce, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="F1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cf, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r1ď㳡'ថ2") returned 1 [0068.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d0, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="i1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d1, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d2, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="F1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d3, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d4, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="i1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d5, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d6, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d7, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d8, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d9, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="S1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217da, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217db, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="t1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217dc, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217dd, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="S1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217de, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217df, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="t1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e0, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e1, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e2, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="d1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e3, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a1ď㳡'ថ2") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e4, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y1ď㳡'ថ2") returned 1 [0068.437] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xac) returned 0x31fa10 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321790, cbMultiByte=1, lpWideCharStr=0x31fa10, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321791, cbMultiByte=1, lpWideCharStr=0x31fa12, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321792, cbMultiByte=1, lpWideCharStr=0x31fa14, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321793, cbMultiByte=1, lpWideCharStr=0x31fa16, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0068.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321794, cbMultiByte=1, lpWideCharStr=0x31fa18, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321795, cbMultiByte=1, lpWideCharStr=0x31fa1a, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321796, cbMultiByte=1, lpWideCharStr=0x31fa1c, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321797, cbMultiByte=1, lpWideCharStr=0x31fa1e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321798, cbMultiByte=1, lpWideCharStr=0x31fa20, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x321799, cbMultiByte=1, lpWideCharStr=0x31fa22, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179a, cbMultiByte=1, lpWideCharStr=0x31fa24, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179b, cbMultiByte=1, lpWideCharStr=0x31fa26, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179c, cbMultiByte=1, lpWideCharStr=0x31fa28, cchWideChar=1 | out: lpWideCharStr="M") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179d, cbMultiByte=1, lpWideCharStr=0x31fa2a, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179e, cbMultiByte=1, lpWideCharStr=0x31fa2c, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x32179f, cbMultiByte=1, lpWideCharStr=0x31fa2e, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a0, cbMultiByte=1, lpWideCharStr=0x31fa30, cchWideChar=1 | out: lpWideCharStr="M") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a1, cbMultiByte=1, lpWideCharStr=0x31fa32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a2, cbMultiByte=1, lpWideCharStr=0x31fa34, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a3, cbMultiByte=1, lpWideCharStr=0x31fa36, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a4, cbMultiByte=1, lpWideCharStr=0x31fa38, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a5, cbMultiByte=1, lpWideCharStr=0x31fa3a, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a6, cbMultiByte=1, lpWideCharStr=0x31fa3c, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a7, cbMultiByte=1, lpWideCharStr=0x31fa3e, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a8, cbMultiByte=1, lpWideCharStr=0x31fa40, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217a9, cbMultiByte=1, lpWideCharStr=0x31fa42, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217aa, cbMultiByte=1, lpWideCharStr=0x31fa44, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ab, cbMultiByte=1, lpWideCharStr=0x31fa46, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ac, cbMultiByte=1, lpWideCharStr=0x31fa48, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ad, cbMultiByte=1, lpWideCharStr=0x31fa4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ae, cbMultiByte=1, lpWideCharStr=0x31fa4c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0068.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217af, cbMultiByte=1, lpWideCharStr=0x31fa4e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b0, cbMultiByte=1, lpWideCharStr=0x31fa50, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b1, cbMultiByte=1, lpWideCharStr=0x31fa52, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b2, cbMultiByte=1, lpWideCharStr=0x31fa54, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b3, cbMultiByte=1, lpWideCharStr=0x31fa56, cchWideChar=1 | out: lpWideCharStr="W") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b4, cbMultiByte=1, lpWideCharStr=0x31fa58, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b5, cbMultiByte=1, lpWideCharStr=0x31fa5a, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b6, cbMultiByte=1, lpWideCharStr=0x31fa5c, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b7, cbMultiByte=1, lpWideCharStr=0x31fa5e, cchWideChar=1 | out: lpWideCharStr="W") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b8, cbMultiByte=1, lpWideCharStr=0x31fa60, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217b9, cbMultiByte=1, lpWideCharStr=0x31fa62, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ba, cbMultiByte=1, lpWideCharStr=0x31fa64, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bb, cbMultiByte=1, lpWideCharStr=0x31fa66, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bc, cbMultiByte=1, lpWideCharStr=0x31fa68, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bd, cbMultiByte=1, lpWideCharStr=0x31fa6a, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217be, cbMultiByte=1, lpWideCharStr=0x31fa6c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217bf, cbMultiByte=1, lpWideCharStr=0x31fa6e, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c0, cbMultiByte=1, lpWideCharStr=0x31fa70, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c1, cbMultiByte=1, lpWideCharStr=0x31fa72, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c2, cbMultiByte=1, lpWideCharStr=0x31fa74, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c3, cbMultiByte=1, lpWideCharStr=0x31fa76, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c4, cbMultiByte=1, lpWideCharStr=0x31fa78, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c5, cbMultiByte=1, lpWideCharStr=0x31fa7a, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c6, cbMultiByte=1, lpWideCharStr=0x31fa7c, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c7, cbMultiByte=1, lpWideCharStr=0x31fa7e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c8, cbMultiByte=1, lpWideCharStr=0x31fa80, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217c9, cbMultiByte=1, lpWideCharStr=0x31fa82, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ca, cbMultiByte=1, lpWideCharStr=0x31fa84, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cb, cbMultiByte=1, lpWideCharStr=0x31fa86, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cc, cbMultiByte=1, lpWideCharStr=0x31fa88, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cd, cbMultiByte=1, lpWideCharStr=0x31fa8a, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217ce, cbMultiByte=1, lpWideCharStr=0x31fa8c, cchWideChar=1 | out: lpWideCharStr="F") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217cf, cbMultiByte=1, lpWideCharStr=0x31fa8e, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d0, cbMultiByte=1, lpWideCharStr=0x31fa90, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d1, cbMultiByte=1, lpWideCharStr=0x31fa92, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d2, cbMultiByte=1, lpWideCharStr=0x31fa94, cchWideChar=1 | out: lpWideCharStr="F") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d3, cbMultiByte=1, lpWideCharStr=0x31fa96, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d4, cbMultiByte=1, lpWideCharStr=0x31fa98, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d5, cbMultiByte=1, lpWideCharStr=0x31fa9a, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d6, cbMultiByte=1, lpWideCharStr=0x31fa9c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d7, cbMultiByte=1, lpWideCharStr=0x31fa9e, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d8, cbMultiByte=1, lpWideCharStr=0x31faa0, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217d9, cbMultiByte=1, lpWideCharStr=0x31faa2, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217da, cbMultiByte=1, lpWideCharStr=0x31faa4, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217db, cbMultiByte=1, lpWideCharStr=0x31faa6, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217dc, cbMultiByte=1, lpWideCharStr=0x31faa8, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217dd, cbMultiByte=1, lpWideCharStr=0x31faaa, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217de, cbMultiByte=1, lpWideCharStr=0x31faac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217df, cbMultiByte=1, lpWideCharStr=0x31faae, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e0, cbMultiByte=1, lpWideCharStr=0x31fab0, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e1, cbMultiByte=1, lpWideCharStr=0x31fab2, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e2, cbMultiByte=1, lpWideCharStr=0x31fab4, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e3, cbMultiByte=1, lpWideCharStr=0x31fab6, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3217e4, cbMultiByte=1, lpWideCharStr=0x31fab8, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0068.441] GetLastError () returned 0x0 [0068.441] SetLastError (dwErrCode=0x0) [0068.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x87) returned 0x33aa10 [0068.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a500 | out: hHeap=0x310000) returned 1 [0068.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x87) returned 0x33b160 [0068.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33aa10 | out: hHeap=0x310000) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b160, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b161, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="J3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b162, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b163, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b164, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b165, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="J3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b166, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b167, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="n3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b168, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b169, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16a, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16b, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16c, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16d, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="F3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16e, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b16f, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="b3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b170, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b171, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="F3ď㳺'녠3") returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b172, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="e3ď㳺'녠3") returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b173, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="b3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b174, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b175, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="u3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b176, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b177, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b178, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="y3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b179, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17a, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="M3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17b, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17c, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17d, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17e, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="M3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b17f, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="a3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b180, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b181, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="c3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b182, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="h3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b183, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b184, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="A3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b185, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="p3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b186, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b187, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr=":3ď㳺'녠3") returned 1 [0068.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b188, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="A3ď㳺'녠3") returned 1 [0068.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b189, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="p3ď㳺'녠3") returned 1 [0068.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x33b18a, cbMultiByte=1, lpWideCharStr=0x10ff890, cchWideChar=1 | out: lpWideCharStr="r3ď㳺'녠3") returned 1 [0068.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10e) returned 0x3310b0 [0068.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1a) returned 0x338aa0 [0068.474] SetLastError (dwErrCode=0x0) [0068.474] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x22, lpLCData=0x10ff8e8, cchData=2 | out: lpLCData="0") returned 2 [0068.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3396d8 [0068.474] GetLastError () returned 0x0 [0068.474] SetLastError (dwErrCode=0x0) [0068.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x488) returned 0x33c180 [0068.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x34) returned 0x32d268 [0068.474] GetLastError () returned 0x0 [0068.474] SetLastError (dwErrCode=0x0) [0068.474] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339f18 | out: hHeap=0x310000) returned 1 [0068.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1b) returned 0x338be0 [0068.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338be0 | out: hHeap=0x310000) returned 1 [0068.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1) returned 0x339f18 [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x338bb8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0068.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x32d2a8 [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x338bb8, cbMultiByte=-1, lpWideCharStr=0x32d2a8, cchWideChar=27 | out: lpWideCharStr="English_United States.1252") returned 27 [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] GetLastError () returned 0x0 [0068.475] SetLastError (dwErrCode=0x0) [0068.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8) returned 0x322d10 [0068.476] GetLastError () returned 0x0 [0068.476] SetLastError (dwErrCode=0x0) [0068.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a6) returned 0x33c610 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33c610 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338ac8 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321a00 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d2a8 | out: hHeap=0x310000) returned 1 [0068.476] GetLastError () returned 0x0 [0068.476] SetLastError (dwErrCode=0x0) [0068.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8f4 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x10ff8f4) returned 27 [0068.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1f) returned 0x338be0 [0068.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x338be4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff8f4 | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x10ff8f4) returned 27 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338c80 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338bb8 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x332658 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f7a0 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33b160 | out: hHeap=0x310000) returned 1 [0068.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321790 | out: hHeap=0x310000) returned 1 [0068.476] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339f18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0068.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2) returned 0x33a128 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x339f18, cbMultiByte=-1, lpWideCharStr=0x33a128, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8) returned 0x321a00 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a6) returned 0x33c610 [0068.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33c610 | out: hHeap=0x310000) returned 1 [0068.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338be0 | out: hHeap=0x310000) returned 1 [0068.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d10 | out: hHeap=0x310000) returned 1 [0068.477] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33a128 | out: hHeap=0x310000) returned 1 [0068.477] GetLastError () returned 0x0 [0068.477] SetLastError (dwErrCode=0x0) [0068.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff93c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x10ff93c) returned 27 [0068.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1f) returned 0x338ed8 [0068.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x338edc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff93c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x10ff93c) returned 27 [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] GetLastError () returned 0x0 [0068.478] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.479] GetLastError () returned 0x0 [0068.479] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f00 [0068.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f28 [0068.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338f28, cbMultiByte=18, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0068.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337c00 [0068.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338f28, cbMultiByte=18, lpWideCharStr=0x337c00, cchWideChar=18 | out: lpWideCharStr="\\Microsoft\\Windows") returned 18 [0068.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f00 | out: hHeap=0x310000) returned 1 [0068.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f28 | out: hHeap=0x310000) returned 1 [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.480] GetLastError () returned 0x0 [0068.480] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ffa18, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0068.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ffa18, cbMultiByte=7, lpWideCharStr=0x10ff9b0, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0068.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33c610 [0068.481] GetEnvironmentVariableW (in: lpName="AppData", lpBuffer=0x33c610, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0068.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337c00 | out: hHeap=0x310000) returned 1 [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.481] GetLastError () returned 0x0 [0068.481] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.482] SetLastError (dwErrCode=0x0) [0068.482] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.483] SetLastError (dwErrCode=0x0) [0068.483] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338cf8 [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.484] SetLastError (dwErrCode=0x0) [0068.484] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.485] GetLastError () returned 0x0 [0068.485] SetLastError (dwErrCode=0x0) [0068.486] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337e68 [0068.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338cf8 | out: hHeap=0x310000) returned 1 [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.486] SetLastError (dwErrCode=0x0) [0068.486] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f00 [0068.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ca8 [0068.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f00 | out: hHeap=0x310000) returned 1 [0068.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337ca8, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0068.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x31f7a0 [0068.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337ca8, cbMultiByte=45, lpWideCharStr=0x31f7a0, cchWideChar=45 | out: lpWideCharStr="Global\\{9C61D451-7F20-44BF-813F-62A330E0300E}") returned 45 [0068.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337e68 | out: hHeap=0x310000) returned 1 [0068.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ca8 | out: hHeap=0x310000) returned 1 [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.487] GetLastError () returned 0x0 [0068.487] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] GetLastError () returned 0x0 [0068.488] SetLastError (dwErrCode=0x0) [0068.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ffa18, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0068.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ffa18, cbMultiByte=6, lpWideCharStr=0x10ff9b0, cchWideChar=6 | out: lpWideCharStr="update") returned 6 [0068.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8c) returned 0x332658 [0068.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x336198 [0068.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x14) returned 0x32a4a0 [0068.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a780 [0068.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a4c0 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3326f0 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x322d10 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x124) returned 0x33c828 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d4c8 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a520 [0068.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x322d88 [0068.490] GetVolumeInformationW (in: lpRootPathName=0x0, lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x10ff7e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ff7e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c58 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f00 [0068.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338c58 | out: hHeap=0x310000) returned 1 [0068.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338d20 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ff0 [0068.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338d20 | out: hHeap=0x310000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3270b0 [0068.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ff0 | out: hHeap=0x310000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3270b0 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x33d960 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33da08 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33d960 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33db00 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33da08 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x33dc70 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33db00 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338bb8 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337e68 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338bb8 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327290 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337e68 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327290 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x33d960 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33da08 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33d960 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33db00 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33da08 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x33de90 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33db00 | out: hHeap=0x310000) returned 1 [0068.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dc70 | out: hHeap=0x310000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338ac8 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337f10 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338ac8 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337f10 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c58 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337c00 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338c58 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327150 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337c00 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a560 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ab0 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a560 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x327740 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ab0 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x322d88 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327740 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x33d960 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x322d88 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33d960 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x33d960 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f28 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337df8 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f28 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3271a0 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337df8 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3271a0 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x33daa0 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33db48 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33dc40 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33db48 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x33e0b0 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dc40 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x33daa0 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e0b0 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x33e0b0 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f28 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337b58 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338f28 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327150 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337b58 | out: hHeap=0x310000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x33daa0 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33db48 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33dc40 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33db48 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x33e560 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dc40 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x33daa0 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e560 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x33e560 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a560 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ed8 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a560 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x3270b0 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ed8 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x322d88 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3270b0 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x33daa0 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x322d88 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x33daa0 [0068.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c8) returned 0x33dbe0 [0068.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2a0) returned 0x33ea10 [0068.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dbe0 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x3f0) returned 0x33ecb8 [0068.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ea10 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e8) returned 0x33f0b0 [0068.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ecb8 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8d0) returned 0x33f6a0 [0068.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33f0b0 | out: hHeap=0x310000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c30 [0068.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd38) returned 0x33ff78 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33f6a0 | out: hHeap=0x310000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f28 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x13eb) returned 0x33ea10 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ff78 | out: hHeap=0x310000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c80 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338ac8 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1dc3) returned 0x33fe08 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ea10 | out: hHeap=0x310000) returned 1 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e560 | out: hHeap=0x310000) returned 1 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e0b0 | out: hHeap=0x310000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c58 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338028 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338c58 | out: hHeap=0x310000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3270b0 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338028 | out: hHeap=0x310000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3270b0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x33daa0 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33db48 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33dc40 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33db48 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338af0 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ab0 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338af0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327150 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ab0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x33ddb0 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x322d88 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ddb0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x33daa0 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x341bd8 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338c58 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a560 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338af0 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337d18 [0068.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a560 | out: hHeap=0x310000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338bb8 [0068.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x327740 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337d18 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x322d88 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327740 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x33ddb0 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338be0 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338ca8 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x322d88 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ddb0 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338cf8 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337b58 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338cf8 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338cf8 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x33daa0 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338d20 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3391d0 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339068 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337c00 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339068 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c8) returned 0x341d48 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338fa0 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ce0 [0068.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338fa0 | out: hHeap=0x310000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f50 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3390b8 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338f78 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338fa0 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3390e0 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2a0) returned 0x341f18 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341d48 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338fc8 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x338ff0 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339018 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337c38 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339018 | out: hHeap=0x310000) returned 1 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dc40 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339068 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337b90 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339068 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3270b0 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337b90 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3270b0 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x341bd8 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x341c80 [0068.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x341d78 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341c80 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3391f8 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337df8 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3391f8 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337df8 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x341bd8 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x341c80 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x33daa0 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341c80 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339108 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a580 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339068 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337d50 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a580 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3391a8 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x327290 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337d50 | out: hHeap=0x310000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339130 [0068.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ff0 [0068.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339130 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x322d88 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327290 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339130 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x341bd8 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339018 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339090 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x322d88 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339040 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339158 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339180 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ab0 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x339180 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x341bd8 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x339180 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3391f8 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342858 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342948 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c8) returned 0x33dc10 [0068.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342880 [0068.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3428a8 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342998 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3428f8 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3428d0 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342970 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337fb8 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342970 | out: hHeap=0x310000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2a0) returned 0x3429c8 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dc10 | out: hHeap=0x310000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342970 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342740 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3427b8 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3426f0 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342718 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342830 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342920 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33daa0 | out: hHeap=0x310000) returned 1 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341d78 | out: hHeap=0x310000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a560 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342790 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ae8 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342790 | out: hHeap=0x310000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0068.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ae8 | out: hHeap=0x310000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338028 [0068.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3270b0 [0068.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338028 | out: hHeap=0x310000) returned 1 [0068.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0068.503] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74bc0000 [0068.503] GetProcAddress (hModule=0x74bc0000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x74c8b830 [0068.503] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x10ff70c | out: lpSystemTimeAsFileTime=0x10ff70c) [0068.503] GetLastError () returned 0x0 [0068.503] SetLastError (dwErrCode=0x0) [0068.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x322d88 [0068.503] GetLastError () returned 0x0 [0068.503] SetLastError (dwErrCode=0x0) [0068.503] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.504] SetLastError (dwErrCode=0x0) [0068.504] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.507] GetLastError () returned 0x0 [0068.507] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] GetLastError () returned 0x0 [0068.508] SetLastError (dwErrCode=0x0) [0068.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff764, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0068.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3427e0 [0068.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff764, cbMultiByte=12, lpWideCharStr=0x3427e0, cchWideChar=12 | out: lpWideCharStr="_readme_.txt") returned 12 [0068.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337df8 [0068.508] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.508] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3427e0 | out: hHeap=0x310000) returned 1 [0068.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338028 [0068.508] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327150 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338028 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x341bd8 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x341c80 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x341d78 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341c80 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x342c70 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341d78 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x341bd8 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342c70 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x33e0b0 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6f7) returned 0x33e560 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e0b0 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337e30 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x327150 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337e30 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x322d88 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x341bd8 [0068.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322d88 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x341c80 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x341d78 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341c80 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x342c70 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341d78 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x341bd8 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342c70 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x33e0b0 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341bd8 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6f7) returned 0x33ec60 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e0b0 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x630) returned 0x33f360 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33ec60 | out: hHeap=0x310000) returned 1 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e560 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x947) returned 0x33e0b0 [0068.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33f360 | out: hHeap=0x310000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d3a8 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d510 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d708 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d828 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d6c0 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d630 [0068.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d558 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d750 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d318 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d5e8 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d5a0 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d2d0 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d288 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d360 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d678 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d3f0 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d438 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d798 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d7e0 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d870 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d8b8 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c) returned 0x342790 [0068.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d900 [0068.511] RtlInitializeConditionVariable (in: ConditionVariable=0x336e14 | out: ConditionVariable=0x336e14) [0068.511] GetLastError () returned 0x0 [0068.511] SetLastError (dwErrCode=0x0) [0068.511] GetLastError () returned 0x0 [0068.511] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x342768, cchWideChar=8 | out: lpWideCharStr="\\Windows") returned 8 [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.512] SetLastError (dwErrCode=0x0) [0068.512] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] GetLastError () returned 0x0 [0068.513] SetLastError (dwErrCode=0x0) [0068.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x3427e0, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.514] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x341bd8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3427e0 | out: hHeap=0x310000) returned 1 [0068.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.514] GetLastError () returned 0x0 [0068.514] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0068.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=14, lpWideCharStr=0x342768, cchWideChar=14 | out: lpWideCharStr="\\Program Files") returned 14 [0068.515] GetLastError () returned 0x0 [0068.515] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.516] SetLastError (dwErrCode=0x0) [0068.516] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x3427e0, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.517] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x342c70, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.517] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a180 | out: hHeap=0x310000) returned 1 [0068.517] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3427e0 | out: hHeap=0x310000) returned 1 [0068.517] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.517] GetLastError () returned 0x0 [0068.517] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.518] SetLastError (dwErrCode=0x0) [0068.518] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3427e0, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0068.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3427e0, cbMultiByte=16, lpWideCharStr=0x337e30, cchWideChar=16 | out: lpWideCharStr="\\Users\\All Users") returned 16 [0068.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3427e0 | out: hHeap=0x310000) returned 1 [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.519] SetLastError (dwErrCode=0x0) [0068.519] GetLastError () returned 0x0 [0068.520] SetLastError (dwErrCode=0x0) [0068.520] GetLastError () returned 0x0 [0068.520] SetLastError (dwErrCode=0x0) [0068.520] GetLastError () returned 0x0 [0068.520] SetLastError (dwErrCode=0x0) [0068.520] GetLastError () returned 0x0 [0068.520] SetLastError (dwErrCode=0x0) [0068.520] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342768, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33daa0 [0068.521] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x33daa0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x327150 [0068.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ea0 | out: hHeap=0x310000) returned 1 [0068.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337e30 | out: hHeap=0x310000) returned 1 [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.521] GetLastError () returned 0x0 [0068.521] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0068.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=6, lpWideCharStr=0x10ff7b0, cchWideChar=6 | out: lpWideCharStr="PUBLIC") returned 6 [0068.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33ea00 [0068.522] GetEnvironmentVariableW (in: lpName="PUBLIC", lpBuffer=0x33ea00, nSize=0x104 | out: lpBuffer="C:\\Users\\Public") returned 0xf [0068.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0068.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=3, lpWideCharStr=0x10ff7b0, cchWideChar=3 | out: lpWideCharStr="TMP") returned 3 [0068.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33ec18 [0068.522] GetEnvironmentVariableW (in: lpName="TMP", lpBuffer=0x33ec18, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0068.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x341e58 [0068.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341df0 | out: hHeap=0x310000) returned 1 [0068.522] GetLastError () returned 0x0 [0068.522] SetLastError (dwErrCode=0x0) [0068.522] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.523] SetLastError (dwErrCode=0x0) [0068.523] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] GetLastError () returned 0x0 [0068.524] SetLastError (dwErrCode=0x0) [0068.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3427e0 [0068.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3427e0, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0068.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337d18 [0068.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3427e0, cbMultiByte=17, lpWideCharStr=0x337d18, cchWideChar=17 | out: lpWideCharStr="PROGRAMFILES(x86)") returned 17 [0068.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3427e0 | out: hHeap=0x310000) returned 1 [0068.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33ee30 [0068.525] GetEnvironmentVariableW (in: lpName="PROGRAMFILES(x86)", lpBuffer=0x33ee30, nSize=0x104 | out: lpBuffer="C:\\Program Files (x86)") returned 0x16 [0068.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337d18 | out: hHeap=0x310000) returned 1 [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] GetLastError () returned 0x0 [0068.525] SetLastError (dwErrCode=0x0) [0068.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x342768, cchWideChar=8 | out: lpWideCharStr="\\AppData") returned 8 [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.526] GetLastError () returned 0x0 [0068.526] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.527] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342808 [0068.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342808, cchWideChar=11 | out: lpWideCharStr="USERPROFILE") returned 11 [0068.527] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33f048 [0068.527] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x33f048, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0068.527] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x342e88 [0068.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341e58 | out: hHeap=0x310000) returned 1 [0068.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342808 | out: hHeap=0x310000) returned 1 [0068.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.527] GetLastError () returned 0x0 [0068.527] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] GetLastError () returned 0x0 [0068.528] SetLastError (dwErrCode=0x0) [0068.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342768, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0068.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33f260 [0068.528] GetEnvironmentVariableW (in: lpName="ProgramData", lpBuffer=0x33f260, nSize=0x104 | out: lpBuffer="C:\\ProgramData") returned 0xe [0068.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.528] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.529] SetLastError (dwErrCode=0x0) [0068.529] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0068.530] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=15, lpWideCharStr=0x342768, cchWideChar=15 | out: lpWideCharStr="ALLUSERSPROFILE") returned 15 [0068.530] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33f478 [0068.530] GetEnvironmentVariableW (in: lpName="ALLUSERSPROFILE", lpBuffer=0x33f478, nSize=0x104 | out: lpBuffer="C:\\ProgramData") returned 0xe [0068.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342768 | out: hHeap=0x310000) returned 1 [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.530] SetLastError (dwErrCode=0x0) [0068.530] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] GetLastError () returned 0x0 [0068.531] SetLastError (dwErrCode=0x0) [0068.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0068.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3427e0 [0068.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x3427e0, cchWideChar=11 | out: lpWideCharStr="Tor Browser") returned 11 [0068.532] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x33dcb8 [0068.532] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342e88 | out: hHeap=0x310000) returned 1 [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] GetLastError () returned 0x0 [0068.532] SetLastError (dwErrCode=0x0) [0068.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.532] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342768 [0068.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=8, lpWideCharStr=0x342768, cchWideChar=8 | out: lpWideCharStr="MSOCache") returned 8 [0068.533] GetLastError () returned 0x0 [0068.533] SetLastError (dwErrCode=0x0) [0068.533] GetLastError () returned 0x0 [0068.533] SetLastError (dwErrCode=0x0) [0068.533] GetLastError () returned 0x0 [0068.533] SetLastError (dwErrCode=0x0) [0068.533] GetLastError () returned 0x0 [0068.533] SetLastError (dwErrCode=0x0) [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342808 [0068.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342808, cchWideChar=11 | out: lpWideCharStr="ProgramData") returned 11 [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3423d0 [0068.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=13, lpWideCharStr=0x3423d0, cchWideChar=13 | out: lpWideCharStr="Program Files") returned 13 [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c8) returned 0x33f690 [0068.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33dcb8 | out: hHeap=0x310000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342218 [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ea0 [0068.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342218 | out: hHeap=0x310000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342560 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337b90 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342560 | out: hHeap=0x310000) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337b90, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337b90, cbMultiByte=40, lpWideCharStr=0x341df0, cchWideChar=40 | out: lpWideCharStr="\\Program Files\\Microsoft\\Exchange Server") returned 40 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ea0 | out: hHeap=0x310000) returned 1 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337b90 | out: hHeap=0x310000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3423f8 [0068.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x3423f8, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33f860 [0068.534] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x33f860, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a0a0 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3423f8 | out: hHeap=0x310000) returned 1 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341df0 | out: hHeap=0x310000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342268 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337f48 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342268 | out: hHeap=0x310000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3425d8 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338060 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3425d8 | out: hHeap=0x310000) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338060, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0068.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338060, cbMultiByte=46, lpWideCharStr=0x341df0, cchWideChar=46 | out: lpWideCharStr="\\Program Files (x86)\\Microsoft\\Exchange Server") returned 46 [0068.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337f48 | out: hHeap=0x310000) returned 1 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338060 | out: hHeap=0x310000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342628 [0068.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342628, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x33fa78 [0068.535] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x33fa78, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337f48 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a0a0 | out: hHeap=0x310000) returned 1 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342628 | out: hHeap=0x310000) returned 1 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341df0 | out: hHeap=0x310000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342628 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ae8 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342628 | out: hHeap=0x310000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342470 [0068.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337c70 [0068.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342470 | out: hHeap=0x310000) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337c70, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0068.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x336ea0 [0068.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x337c70, cbMultiByte=35, lpWideCharStr=0x336ea0, cchWideChar=35 | out: lpWideCharStr="\\Program Files\\Microsoft SQL Server") returned 35 [0068.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ae8 | out: hHeap=0x310000) returned 1 [0068.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337c70 | out: hHeap=0x310000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342498 [0068.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342498, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x342e88 [0068.536] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x342e88, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x3272e0 [0068.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337f48 | out: hHeap=0x310000) returned 1 [0068.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342498 | out: hHeap=0x310000) returned 1 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x336ea0 | out: hHeap=0x310000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342218 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337f10 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342218 | out: hHeap=0x310000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342218 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338028 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342218 | out: hHeap=0x310000) returned 1 [0068.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338028, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x338028, cbMultiByte=41, lpWideCharStr=0x341df0, cchWideChar=41 | out: lpWideCharStr="\\Program Files (x86)\\Microsoft SQL Server") returned 41 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337f10 | out: hHeap=0x310000) returned 1 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338028 | out: hHeap=0x310000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342358 [0068.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=11, lpWideCharStr=0x342358, cchWideChar=11 | out: lpWideCharStr="SYSTEMDRIVE") returned 11 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3430a0 [0068.537] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x3430a0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341e58 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3272e0 | out: hHeap=0x310000) returned 1 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342358 | out: hHeap=0x310000) returned 1 [0068.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341df0 | out: hHeap=0x310000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x120) returned 0x33fc90 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x120) returned 0x33dcb8 [0068.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1493) returned 0x3432b8 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342628 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3426c8 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342420 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342268 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1493) returned 0x344758 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342560 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3421f0 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342218 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342650 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342240 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3422e0 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342290 [0068.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff818, cbMultiByte=12, lpWideCharStr=0x342290, cchWideChar=12 | out: lpWideCharStr="_readme_.txt") returned 12 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d120 [0068.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33c988 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33cbc8 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33cfb8 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342240 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342628 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3426c8 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342420 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342268 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3432b8 | out: hHeap=0x310000) returned 1 [0068.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33fc90 | out: hHeap=0x310000) returned 1 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x33dde0 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33c9d0 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a180 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33cdc0 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33caa8 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33cd30 [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33ce08 [0068.539] GetSystemInfo (in: lpSystemInfo=0x10ff8d4 | out: lpSystemInfo=0x10ff8d4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0068.539] CreateIoCompletionPort (FileHandle=0xffffffff, ExistingCompletionPort=0x0, CompletionKey=0x0, NumberOfConcurrentThreads=0x10) returned 0x23c [0068.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a340 [0068.540] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a34c | out: phModule=0x32a34c*=0x250000) returned 1 [0068.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a340, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x13f4) returned 0x240 [0068.541] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c) returned 0x342240 [0068.541] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a060 [0068.541] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a06c | out: phModule=0x32a06c*=0x250000) returned 1 [0068.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a060, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x13f8) returned 0x244 [0068.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x38) returned 0x32d2a8 [0068.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342240 | out: hHeap=0x310000) returned 1 [0068.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a0a0 [0068.542] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a0ac | out: phModule=0x32a0ac*=0x250000) returned 1 [0068.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a0a0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x13fc) returned 0x248 [0068.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x54) returned 0x321790 [0068.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d2a8 | out: hHeap=0x310000) returned 1 [0068.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a360 [0068.543] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a36c | out: phModule=0x32a36c*=0x250000) returned 1 [0068.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a360, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0xa24) returned 0x24c [0068.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x33fc90 [0068.544] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x321790 | out: hHeap=0x310000) returned 1 [0068.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a0e0 [0068.544] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a0ec | out: phModule=0x32a0ec*=0x250000) returned 1 [0068.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a0e0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0xff0) returned 0x250 [0068.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa8) returned 0x3256f0 [0068.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33fc90 | out: hHeap=0x310000) returned 1 [0068.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a2e0 [0068.545] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a2ec | out: phModule=0x32a2ec*=0x250000) returned 1 [0068.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a2e0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x1098) returned 0x254 [0068.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a2a0 [0068.546] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a2ac | out: phModule=0x32a2ac*=0x250000) returned 1 [0068.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a2a0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x1094) returned 0x258 [0068.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xfc) returned 0x33fc90 [0068.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3256f0 | out: hHeap=0x310000) returned 1 [0068.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a2c0 [0068.547] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a2cc | out: phModule=0x32a2cc*=0x250000) returned 1 [0068.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a2c0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10b8) returned 0x25c [0068.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a240 [0068.548] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a24c | out: phModule=0x32a24c*=0x250000) returned 1 [0068.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a240, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10b4) returned 0x260 [0068.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a0c0 [0068.549] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a0cc | out: phModule=0x32a0cc*=0x250000) returned 1 [0068.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a0c0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10d8) returned 0x264 [0068.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x16c) returned 0x345bf8 [0068.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33fc90 | out: hHeap=0x310000) returned 1 [0068.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a1e0 [0068.550] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a1ec | out: phModule=0x32a1ec*=0x250000) returned 1 [0068.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a1e0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10d0) returned 0x268 [0068.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a260 [0068.591] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a26c | out: phModule=0x32a26c*=0x250000) returned 1 [0068.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a260, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10d4) returned 0x26c [0068.592] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a300 [0068.592] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a30c | out: phModule=0x32a30c*=0x250000) returned 1 [0068.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a300, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x10fc) returned 0x270 [0068.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a140 [0068.593] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a14c | out: phModule=0x32a14c*=0x250000) returned 1 [0068.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a140, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x1104) returned 0x274 [0068.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x214) returned 0x34cd78 [0068.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x345bf8 | out: hHeap=0x310000) returned 1 [0068.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a3a0 [0068.594] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a3ac | out: phModule=0x32a3ac*=0x250000) returned 1 [0068.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a3a0, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x1110) returned 0x278 [0068.596] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x32a320 [0068.596] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x261b00, phModule=0x32a32c | out: phModule=0x32a32c*=0x250000) returned 1 [0068.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x32a320, dwCreationFlags=0x0, lpThreadId=0x10ff8dc | out: lpThreadId=0x10ff8dc*=0x1108) returned 0x27c [0068.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x34cf98 [0068.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34cf98, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\buiransomsample.exe")) returned 0x2b [0068.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342470 [0068.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x34cf98 | out: hHeap=0x310000) returned 1 [0068.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c) returned 0x3423a8 [0068.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x32a000 [0068.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342240 [0068.598] GetLastError () returned 0x0 [0068.598] SetLastError (dwErrCode=0x0) [0068.598] GetLastError () returned 0x0 [0068.601] SetLastError (dwErrCode=0x0) [0068.601] GetLastError () returned 0x0 [0068.601] SetLastError (dwErrCode=0x0) [0068.601] GetLastError () returned 0x0 [0068.601] SetLastError (dwErrCode=0x0) [0068.601] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0068.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x10ff860, cchWideChar=7 | out: lpWideCharStr="svchost") returned 7 [0068.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ca8 [0068.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32a000 | out: hHeap=0x310000) returned 1 [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.602] GetLastError () returned 0x0 [0068.602] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0068.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=5, lpWideCharStr=0x10ff860, cchWideChar=5 | out: lpWideCharStr="csrss") returned 5 [0068.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x327150 [0068.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ca8 | out: hHeap=0x310000) returned 1 [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.603] SetLastError (dwErrCode=0x0) [0068.603] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.604] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3426a0 [0068.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x3426a0, cchWideChar=8 | out: lpWideCharStr="services") returned 8 [0068.604] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.604] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327150 | out: hHeap=0x310000) returned 1 [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] GetLastError () returned 0x0 [0068.604] SetLastError (dwErrCode=0x0) [0068.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0068.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=5, lpWideCharStr=0x10ff860, cchWideChar=5 | out: lpWideCharStr="lsass") returned 5 [0068.604] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x345bf8 [0068.605] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341df0 | out: hHeap=0x310000) returned 1 [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] GetLastError () returned 0x0 [0068.605] SetLastError (dwErrCode=0x0) [0068.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3423f8 [0068.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x3423f8, cchWideChar=8 | out: lpWideCharStr="winlogon") returned 8 [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] GetLastError () returned 0x0 [0068.606] SetLastError (dwErrCode=0x0) [0068.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0068.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x10ff860, cchWideChar=7 | out: lpWideCharStr="spoolsv") returned 7 [0068.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x345c90 [0068.606] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x345bf8 | out: hHeap=0x310000) returned 1 [0068.606] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] GetLastError () returned 0x0 [0068.607] SetLastError (dwErrCode=0x0) [0068.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0068.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342588 [0068.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=8, lpWideCharStr=0x342588, cchWideChar=8 | out: lpWideCharStr="explorer") returned 8 [0068.607] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.608] SetLastError (dwErrCode=0x0) [0068.608] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0068.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3424c0 [0068.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=13, lpWideCharStr=0x3424c0, cchWideChar=13 | out: lpWideCharStr="RuntimeBroker") returned 13 [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.609] SetLastError (dwErrCode=0x0) [0068.609] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0068.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=6, lpWideCharStr=0x10ff860, cchWideChar=6 | out: lpWideCharStr="System") returned 6 [0068.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x33fc90 [0068.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x345c90 | out: hHeap=0x310000) returned 1 [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] GetLastError () returned 0x0 [0068.610] SetLastError (dwErrCode=0x0) [0068.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0068.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=6, lpWideCharStr=0x10ff860, cchWideChar=6 | out: lpWideCharStr="System") returned 6 [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.611] GetLastError () returned 0x0 [0068.611] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0068.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342600 [0068.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=10, lpWideCharStr=0x342600, cchWideChar=10 | out: lpWideCharStr="powershell") returned 10 [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.612] GetLastError () returned 0x0 [0068.612] SetLastError (dwErrCode=0x0) [0068.613] GetLastError () returned 0x0 [0068.613] SetLastError (dwErrCode=0x0) [0068.613] GetLastError () returned 0x0 [0068.613] SetLastError (dwErrCode=0x0) [0068.613] GetLastError () returned 0x0 [0068.613] SetLastError (dwErrCode=0x0) [0068.613] GetLastError () returned 0x0 [0068.613] SetLastError (dwErrCode=0x0) [0068.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0068.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff8d0, cbMultiByte=7, lpWideCharStr=0x10ff860, cchWideChar=7 | out: lpWideCharStr="wscript") returned 7 [0068.613] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.617] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0068.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342470 | out: hHeap=0x310000) returned 1 [0068.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f7a0 | out: hHeap=0x310000) returned 1 [0068.649] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x341df0 [0068.649] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="Global\\{9C61D451-7F20-44BF-813F-62A330E0300E}") returned 0x0 [0068.649] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\{9C61D451-7F20-44BF-813F-62A330E0300E}") returned 0x2c8 [0068.649] IsDebuggerPresent () returned 0 [0068.650] GetCurrentProcess () returned 0xffffffff [0068.650] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x10ff674 | out: pbDebuggerPresent=0x10ff674) returned 1 [0068.651] GetCurrentThread () returned 0xfffffffe [0068.651] GetThreadContext (in: hThread=0xfffffffe, lpContext=0x10ff3a8 | out: lpContext=0x10ff3a8*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0068.651] GetLastError () returned 0x0 [0068.651] SetLastError (dwErrCode=0x0) [0068.651] GetLastError () returned 0x0 [0068.651] SetLastError (dwErrCode=0x0) [0068.651] GetLastError () returned 0x0 [0068.651] SetLastError (dwErrCode=0x0) [0068.651] GetLastError () returned 0x0 [0068.651] SetLastError (dwErrCode=0x0) [0068.651] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff5c4, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0068.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342380 [0068.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff5c4, cbMultiByte=9, lpWideCharStr=0x342380, cchWideChar=9 | out: lpWideCharStr="EnableLUA") returned 9 [0068.652] GetLastError () returned 0x0 [0068.652] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.653] SetLastError (dwErrCode=0x0) [0068.653] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] GetLastError () returned 0x0 [0068.654] SetLastError (dwErrCode=0x0) [0068.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342448 [0068.654] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.655] GetLastError () returned 0x0 [0068.655] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338060 [0068.656] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342448 | out: hHeap=0x310000) returned 1 [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.656] SetLastError (dwErrCode=0x0) [0068.656] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.657] GetLastError () returned 0x0 [0068.657] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3271a0 [0068.658] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338060 | out: hHeap=0x310000) returned 1 [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.658] SetLastError (dwErrCode=0x0) [0068.658] GetLastError () returned 0x0 [0068.659] SetLastError (dwErrCode=0x0) [0068.659] GetLastError () returned 0x0 [0068.659] SetLastError (dwErrCode=0x0) [0068.659] GetLastError () returned 0x0 [0068.659] SetLastError (dwErrCode=0x0) [0068.659] GetLastError () returned 0x0 [0068.659] SetLastError (dwErrCode=0x0) [0068.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342448 [0068.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337e68 [0068.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342448 | out: hHeap=0x310000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0068.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337e68 | out: hHeap=0x310000) returned 1 [0068.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3275b0, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0068.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x31f7a0 [0068.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3275b0, cbMultiByte=57, lpWideCharStr=0x31f7a0, cchWideChar=57 | out: lpWideCharStr="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0068.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3271a0 | out: hHeap=0x310000) returned 1 [0068.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0068.659] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0xf003f, phkResult=0x10ff678 | out: phkResult=0x10ff678*=0x2cc) returned 0x0 [0068.660] RegSetValueExW (in: hKey=0x2cc, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x10ff674*=0x0, cbData=0x4 | out: lpData=0x10ff674*=0x0) returned 0x0 [0068.660] RegCloseKey (hKey=0x2cc) returned 0x0 [0068.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f7a0 | out: hHeap=0x310000) returned 1 [0068.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342380 | out: hHeap=0x310000) returned 1 [0068.660] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.669] GetLastError () returned 0x0 [0068.669] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] GetLastError () returned 0x0 [0068.670] SetLastError (dwErrCode=0x0) [0068.670] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342380 [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] GetLastError () returned 0x0 [0068.671] SetLastError (dwErrCode=0x0) [0068.671] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342448 [0068.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x342448, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0068.672] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x33d240 [0068.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x342448, cbMultiByte=26, lpWideCharStr=0x33d240, cchWideChar=26 | out: lpWideCharStr="ConsentPromptBehaviorAdmin") returned 26 [0068.672] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342380 | out: hHeap=0x310000) returned 1 [0068.672] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342448 | out: hHeap=0x310000) returned 1 [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.672] GetLastError () returned 0x0 [0068.672] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.673] SetLastError (dwErrCode=0x0) [0068.673] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342510 [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.674] GetLastError () returned 0x0 [0068.674] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.675] SetLastError (dwErrCode=0x0) [0068.675] GetLastError () returned 0x0 [0068.676] SetLastError (dwErrCode=0x0) [0068.676] GetLastError () returned 0x0 [0068.676] SetLastError (dwErrCode=0x0) [0068.676] GetLastError () returned 0x0 [0068.676] SetLastError (dwErrCode=0x0) [0068.676] GetLastError () returned 0x0 [0068.676] SetLastError (dwErrCode=0x0) [0068.678] GetLastError () returned 0x0 [0068.678] SetLastError (dwErrCode=0x0) [0068.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ca8 [0068.678] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342510 | out: hHeap=0x310000) returned 1 [0068.678] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.679] SetLastError (dwErrCode=0x0) [0068.679] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0068.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ca8 | out: hHeap=0x310000) returned 1 [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.680] GetLastError () returned 0x0 [0068.680] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] GetLastError () returned 0x0 [0068.681] SetLastError (dwErrCode=0x0) [0068.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342510 [0068.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x338060 [0068.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342510 | out: hHeap=0x310000) returned 1 [0068.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3271a0 [0068.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338060 | out: hHeap=0x310000) returned 1 [0068.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3271a0, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0068.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x31f7a0 [0068.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3271a0, cbMultiByte=57, lpWideCharStr=0x31f7a0, cchWideChar=57 | out: lpWideCharStr="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System") returned 57 [0068.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0068.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3271a0 | out: hHeap=0x310000) returned 1 [0068.682] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0xf003f, phkResult=0x10ff678 | out: phkResult=0x10ff678*=0x2cc) returned 0x0 [0068.682] RegSetValueExW (in: hKey=0x2cc, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x10ff674*=0x0, cbData=0x4 | out: lpData=0x10ff674*=0x0) returned 0x0 [0068.696] RegCloseKey (hKey=0x2cc) returned 0x0 [0068.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f7a0 | out: hHeap=0x310000) returned 1 [0068.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33d240 | out: hHeap=0x310000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x180) returned 0x35a910 [0068.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x180) returned 0x35c4c8 [0068.697] CryptAcquireContextW (in: phProv=0x33de3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x33de3c*=0x31f7a0) returned 1 [0069.150] CryptAcquireContextW (in: phProv=0x33ddfc, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0x0 | out: phProv=0x33ddfc*=0x35b0f0) returned 1 [0069.569] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDz18S0yxFC6OFIovK/20zsWeO+BLe9FbXGGHGHRJfvvUTZPkzoYhY8ujfR+rqS8U7raCBEmRN16OnlZGWTJlHwehiG3kJ/0nBIQ7RVEo0O2uhtz+YC08LSswKm727gvGyJFBpE6XSofz+PzGdBMN6q9BAIXDoSHl7QV1/odFnAqviyHLpLMZYVG4G7H4cPoxAYaC3oGYV3FxWMP0/hzJF9KX8VC2sy9s1dd5Mptaj1Lb6y+PpycDgQca1WfeyOnP99Dn/YPYmGASH+yWNMVeM0D0iq97v9am6lIN/k0e+VZPDPYAfHMZkOpMoIh45rQh4lsw6txsknHF/1NBwRLIvd", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x10ff66c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x10ff66c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0069.569] GetProcessHeap () returned 0x310000 [0069.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x114) returned 0x35aa98 [0069.569] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDz18S0yxFC6OFIovK/20zsWeO+BLe9FbXGGHGHRJfvvUTZPkzoYhY8ujfR+rqS8U7raCBEmRN16OnlZGWTJlHwehiG3kJ/0nBIQ7RVEo0O2uhtz+YC08LSswKm727gvGyJFBpE6XSofz+PzGdBMN6q9BAIXDoSHl7QV1/odFnAqviyHLpLMZYVG4G7H4cPoxAYaC3oGYV3FxWMP0/hzJF9KX8VC2sy9s1dd5Mptaj1Lb6y+PpycDgQca1WfeyOnP99Dn/YPYmGASH+yWNMVeM0D0iq97v9am6lIN/k0e+VZPDPYAfHMZkOpMoIh45rQh4lsw6txsknHF/1NBwRLIvd", cchString=0x0, dwFlags=0x1, pbBinary=0x35aa98, pcbBinary=0x10ff66c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x35aa98, pcbBinary=0x10ff66c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0069.569] CryptImportKey (in: hProv=0x31f7a0, pbData=0x35aa98, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x33de38 | out: phKey=0x33de38*=0x35de88) returned 1 [0069.570] GetProcessHeap () returned 0x310000 [0069.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35aa98 | out: hHeap=0x310000) returned 1 [0069.570] CryptGenKey (in: hProv=0x35b0f0, Algid=0x6610, dwFlags=0x1, phKey=0x33de40 | out: phKey=0x33de40*=0x35e2c8) returned 1 [0069.571] CryptExportKey (in: hKey=0x35e2c8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x10ff5d4 | out: pbData=0x0*, pdwDataLen=0x10ff5d4*=0x2c) returned 1 [0069.572] CryptEncrypt (in: hKey=0x35de88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x10ff5cc*=0x2c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x10ff5cc*=0x100) returned 1 [0069.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x110) returned 0x35eb80 [0069.572] CryptExportKey (in: hKey=0x35e2c8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x35eb80, pdwDataLen=0x10ff5e4 | out: pbData=0x35eb80*, pdwDataLen=0x10ff5e4*=0x2c) returned 1 [0069.572] CryptEncrypt (in: hKey=0x35de88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x35eb80*, pdwDataLen=0x10ff5e0*=0x2c, dwBufLen=0x100 | out: pbData=0x35eb80*, pdwDataLen=0x10ff5e0*=0x100) returned 1 [0069.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342510 [0069.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".bdCDdCBaAd", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0069.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".bdCDdCBaAd", cchWideChar=11, lpMultiByteStr=0x10ff5b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bdCDdCBaAd", lpUsedDefaultChar=0x0) returned 11 [0069.573] CryptEncrypt (in: hKey=0x35de88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x10ff5cc*=0x2c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x10ff5cc*=0x100) returned 1 [0069.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x110) returned 0x361120 [0069.573] CryptEncrypt (in: hKey=0x35de88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x361120*, pdwDataLen=0x10ff5e0*=0xb, dwBufLen=0x100 | out: pbData=0x361120*, pdwDataLen=0x10ff5e0*=0x100) returned 1 [0069.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361238 [0069.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0069.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342510 | out: hHeap=0x310000) returned 1 [0069.574] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0069.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3595d0 [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.574] SetLastError (dwErrCode=0x0) [0069.574] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342510 [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.575] SetLastError (dwErrCode=0x0) [0069.575] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] GetLastError () returned 0x0 [0069.576] SetLastError (dwErrCode=0x0) [0069.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ca8 [0069.577] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342510 | out: hHeap=0x310000) returned 1 [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.577] SetLastError (dwErrCode=0x0) [0069.577] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] GetLastError () returned 0x0 [0069.578] SetLastError (dwErrCode=0x0) [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3271a0 [0069.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ca8 | out: hHeap=0x310000) returned 1 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342510 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ca8 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361450 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x410) returned 0x361668 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x342538 [0069.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".bdCDdCBaAd", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0069.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".bdCDdCBaAd", cchWideChar=11, lpMultiByteStr=0x10ff490, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bdCDdCBaAd", lpUsedDefaultChar=0x0) returned 11 [0069.578] GetLogicalDrives () returned 0x4 [0069.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362798 [0069.579] WNetGetConnectionW (in: lpLocalName="A:", lpRemoteName=0x362798, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362798 | out: hHeap=0x310000) returned 1 [0069.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363488 [0069.580] WNetGetConnectionW (in: lpLocalName="B:", lpRemoteName=0x363488, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363488 | out: hHeap=0x310000) returned 1 [0069.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3629c0 [0069.580] WNetGetConnectionW (in: lpLocalName="C:", lpRemoteName=0x3629c0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.581] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10ff414, lpBytesPerSector=0x10ff418, lpNumberOfFreeClusters=0x10ff410, lpTotalNumberOfClusters=0x10ff41c | out: lpSectorsPerCluster=0x10ff414, lpBytesPerSector=0x10ff418, lpNumberOfFreeClusters=0x10ff410, lpTotalNumberOfClusters=0x10ff41c) returned 1 [0069.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x28) returned 0x34a410 [0069.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3629c0 | out: hHeap=0x310000) returned 1 [0069.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3636b0 [0069.581] WNetGetConnectionW (in: lpLocalName="D:", lpRemoteName=0x3636b0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3636b0 | out: hHeap=0x310000) returned 1 [0069.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363488 [0069.581] WNetGetConnectionW (in: lpLocalName="E:", lpRemoteName=0x363488, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363488 | out: hHeap=0x310000) returned 1 [0069.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361cd0 [0069.582] WNetGetConnectionW (in: lpLocalName="F:", lpRemoteName=0x361cd0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x310000) returned 1 [0069.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361aa8 [0069.583] WNetGetConnectionW (in: lpLocalName="G:", lpRemoteName=0x361aa8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361aa8 | out: hHeap=0x310000) returned 1 [0069.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363038 [0069.583] WNetGetConnectionW (in: lpLocalName="H:", lpRemoteName=0x363038, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363038 | out: hHeap=0x310000) returned 1 [0069.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362798 [0069.584] WNetGetConnectionW (in: lpLocalName="I:", lpRemoteName=0x362798, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362798 | out: hHeap=0x310000) returned 1 [0069.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361aa8 [0069.597] WNetGetConnectionW (in: lpLocalName="J:", lpRemoteName=0x361aa8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361aa8 | out: hHeap=0x310000) returned 1 [0069.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3629c0 [0069.597] WNetGetConnectionW (in: lpLocalName="K:", lpRemoteName=0x3629c0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.598] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3629c0 | out: hHeap=0x310000) returned 1 [0069.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3636b0 [0069.608] WNetGetConnectionW (in: lpLocalName="L:", lpRemoteName=0x3636b0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3636b0 | out: hHeap=0x310000) returned 1 [0069.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363488 [0069.609] WNetGetConnectionW (in: lpLocalName="M:", lpRemoteName=0x363488, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363488 | out: hHeap=0x310000) returned 1 [0069.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362e10 [0069.609] WNetGetConnectionW (in: lpLocalName="N:", lpRemoteName=0x362e10, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362e10 | out: hHeap=0x310000) returned 1 [0069.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3629c0 [0069.610] WNetGetConnectionW (in: lpLocalName="O:", lpRemoteName=0x3629c0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3629c0 | out: hHeap=0x310000) returned 1 [0069.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361cd0 [0069.610] WNetGetConnectionW (in: lpLocalName="P:", lpRemoteName=0x361cd0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x310000) returned 1 [0069.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361aa8 [0069.611] WNetGetConnectionW (in: lpLocalName="Q:", lpRemoteName=0x361aa8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361aa8 | out: hHeap=0x310000) returned 1 [0069.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362120 [0069.611] WNetGetConnectionW (in: lpLocalName="R:", lpRemoteName=0x362120, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362120 | out: hHeap=0x310000) returned 1 [0069.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362348 [0069.612] WNetGetConnectionW (in: lpLocalName="S:", lpRemoteName=0x362348, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362348 | out: hHeap=0x310000) returned 1 [0069.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361ef8 [0069.613] WNetGetConnectionW (in: lpLocalName="T:", lpRemoteName=0x361ef8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361ef8 | out: hHeap=0x310000) returned 1 [0069.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362be8 [0069.613] WNetGetConnectionW (in: lpLocalName="U:", lpRemoteName=0x362be8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362be8 | out: hHeap=0x310000) returned 1 [0069.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362be8 [0069.615] WNetGetConnectionW (in: lpLocalName="V:", lpRemoteName=0x362be8, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362be8 | out: hHeap=0x310000) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3636b0 [0069.616] WNetGetConnectionW (in: lpLocalName="W:", lpRemoteName=0x3636b0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3636b0 | out: hHeap=0x310000) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361cd0 [0069.616] WNetGetConnectionW (in: lpLocalName="X:", lpRemoteName=0x361cd0, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x310000) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362120 [0069.617] WNetGetConnectionW (in: lpLocalName="Y:", lpRemoteName=0x362120, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362120 | out: hHeap=0x310000) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362570 [0069.617] WNetGetConnectionW (in: lpLocalName="Z:", lpRemoteName=0x362570, lpnLength=0x10ff40c | out: lpRemoteName="", lpnLength=0x10ff40c) returned 0x8ca [0069.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362570 | out: hHeap=0x310000) returned 1 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3640f8 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3640a8 [0069.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3640f8 | out: hHeap=0x310000) returned 1 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x410) returned 0x364290 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x420) returned 0x3646a8 [0069.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3640a8 | out: hHeap=0x310000) returned 1 [0069.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364290 | out: hHeap=0x310000) returned 1 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x62f) returned 0x364ad0 [0069.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3646a8 | out: hHeap=0x310000) returned 1 [0069.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0069.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C", cchWideChar=1, lpMultiByteStr=0x10ff490, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C", lpUsedDefaultChar=0x0) returned 1 [0069.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x110) returned 0x361120 [0069.618] GetLocaleInfoA (in: Locale=0x400, LCType=0x1001, lpLCData=0x361120, cchData=260 | out: lpLCData="English") returned 8 [0069.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0069.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x110) returned 0x361120 [0069.619] GetComputerNameA (in: lpBuffer=0x361120, nSize=0x10ff498 | out: lpBuffer="NQDPDE", nSize=0x10ff498) returned 1 [0069.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0069.619] CryptAcquireContextW (in: phProv=0x10ff494, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x10ff494*=0x35efc0) returned 1 [0069.620] CryptImportKey (in: hProv=0x35efc0, pbData=0x10ff44c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x10ff4a4 | out: phKey=0x10ff4a4*=0x35e548) returned 1 [0069.620] CryptSetKeyParam (hKey=0x35e548, dwParam=0x1, pbData=0x342510, dwFlags=0x0) returned 1 [0069.620] CryptSetKeyParam (hKey=0x35e548, dwParam=0x4, pbData=0x10ff490*=0x1, dwFlags=0x0) returned 1 [0069.620] CryptDuplicateKey (in: hKey=0x35e548, pdwReserved=0x0, dwFlags=0x0, phKey=0x10ff49c | out: phKey=0x10ff49c*=0x35e408) returned 1 [0069.624] CryptEncrypt (in: hKey=0x35e408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x10ff4a0*=0x470, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x10ff4a0*=0x480) returned 1 [0069.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x480) returned 0x365108 [0069.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6bf) returned 0x365590 [0069.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365108 | out: hHeap=0x310000) returned 1 [0069.624] CryptEncrypt (in: hKey=0x35e408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x365590*, pdwDataLen=0x10ff498*=0x470, dwBufLen=0x480 | out: pbData=0x365590*, pdwDataLen=0x10ff498*=0x480) returned 1 [0069.624] CryptDestroyKey (hKey=0x35e408) returned 1 [0069.624] CryptDestroyKey (hKey=0x35e548) returned 1 [0069.624] CryptReleaseContext (hProv=0x35efc0, dwFlags=0x0) returned 1 [0069.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ad0 | out: hHeap=0x310000) returned 1 [0069.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363fe0 [0069.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337d88 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363fe0 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3275b0 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337d88 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x35aca8 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3275b0 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x361120 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35aca8 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x35eb80 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x364290 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x364400 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364290 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x364620 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364400 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x364948 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364620 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6f7) returned 0x364df8 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364948 | out: hHeap=0x310000) returned 1 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365590 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x610) returned 0x364290 [0069.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364df8 | out: hHeap=0x310000) returned 1 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363bd0 [0069.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337d88 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363bd0 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x3272e0 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337d88 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6a) returned 0x35aca8 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3272e0 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x9e) returned 0x361120 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35aca8 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xec) returned 0x35eb80 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x161) returned 0x3648a8 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x211) returned 0x364a18 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3648a8 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x319) returned 0x364c38 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364a18 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x4a5) returned 0x364f60 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c38 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6f7) returned 0x365410 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364f60 | out: hHeap=0x310000) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa72) returned 0x3648a8 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365410 | out: hHeap=0x310000) returned 1 [0069.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364290 | out: hHeap=0x310000) returned 1 [0069.626] GetLastError () returned 0x0 [0069.626] SetLastError (dwErrCode=0x0) [0069.626] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff488, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0069.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff488, cbMultiByte=6, lpWideCharStr=0x10ff420, cchWideChar=6 | out: lpWideCharStr="{{id}}") returned 6 [0069.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{{id}}", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0069.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{{id}}", cchWideChar=6, lpMultiByteStr=0x10ff490, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{{id}}", lpUsedDefaultChar=0x0) returned 6 [0069.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x810) returned 0x365328 [0069.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe50) returned 0x365b40 [0069.627] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x33e0b0 | out: hHeap=0x310000) returned 1 [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.627] GetLastError () returned 0x0 [0069.627] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] GetLastError () returned 0x0 [0069.628] SetLastError (dwErrCode=0x0) [0069.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff488, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0069.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff488, cbMultiByte=7, lpWideCharStr=0x10ff420, cchWideChar=7 | out: lpWideCharStr="{{ext}}") returned 7 [0069.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{{ext}}", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0069.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{{ext}}", cchWideChar=7, lpMultiByteStr=0x10ff490, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{{ext}}", lpUsedDefaultChar=0x0) returned 7 [0069.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x159a) returned 0x366998 [0069.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365b40 | out: hHeap=0x310000) returned 1 [0069.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365328 | out: hHeap=0x310000) returned 1 [0069.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3648a8 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x34a410 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342538 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361668 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361450 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ca8 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x342510 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3271a0 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3595d0 | out: hHeap=0x310000) returned 1 [0069.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x35aca8 [0069.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361aa8 [0069.630] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x361aa8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\buiransomsample.exe")) returned 0x2b [0069.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x337ea0 [0069.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x35efc0 [0069.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x361120 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35efc0 | out: hHeap=0x310000) returned 1 [0069.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x337ea0 | out: hHeap=0x310000) returned 1 [0069.630] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BUIRansomSample.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\buiransomsample.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\BUIRansomSample.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\buiransomsample.exe"), bFailIfExists=0) returned 1 [0070.102] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361aa8 | out: hHeap=0x310000) returned 1 [0070.102] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35aca8 | out: hHeap=0x310000) returned 1 [0070.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x35eb80 [0070.102] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0070.102] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0070.102] CoCreateInstance (in: rclsid=0x2cd8d4*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x2cd8c4*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x10ff648 | out: ppv=0x10ff648*=0x151a240) returned 0x0 [0071.292] TaskScheduler:ITaskService:Connect (This=0x151a240, serverName=0x10ff524*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x10ff534*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x10ff544*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x10ff554*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0071.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x354128 [0071.303] TaskScheduler:ITaskService:GetFolder (in: This=0x151a240, Path="\\", ppFolder=0x10ff64c | out: ppFolder=0x10ff64c*=0x151a318) returned 0x0 [0071.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x354128 | out: hHeap=0x310000) returned 1 [0071.453] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3541d0 [0071.454] ITaskFolder:DeleteTask (This=0x151a318, Name="update", flags=0) returned 0x80070002 [0071.454] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3541d0 | out: hHeap=0x310000) returned 1 [0071.455] TaskScheduler:ITaskService:NewTask (in: This=0x151a240, flags=0x0, ppDefinition=0x10ff650 | out: ppDefinition=0x10ff650*=0x151a378) returned 0x0 [0071.455] TaskScheduler:IUnknown:Release (This=0x151a240) returned 0x1 [0071.457] ITaskDefinition:get_RegistrationInfo (in: This=0x151a378, ppRegistrationInfo=0x10ff628 | out: ppRegistrationInfo=0x10ff628*=0x151a410) returned 0x0 [0071.457] IUnknown:Release (This=0x151a410) returned 0x1 [0071.457] ITaskDefinition:get_Triggers (in: This=0x151a378, ppTriggers=0x10ff638 | out: ppTriggers=0x10ff638*=0x151a568) returned 0x0 [0071.458] ITriggerCollection:Create (in: This=0x151a568, Type=2, ppTrigger=0x10ff634 | out: ppTrigger=0x10ff634*=0x151a620) returned 0x0 [0071.458] IUnknown:Release (This=0x151a568) returned 0x1 [0071.458] IUnknown:QueryInterface (in: This=0x151a620, riid=0x2cd8b4*(Data1=0x126c5cd8, Data2=0xb288, Data3=0x41d5, Data4=([0]=0x8d, [1]=0xbf, [2]=0xe4, [3]=0x91, [4]=0x44, [5]=0x6a, [6]=0xdc, [7]=0x5c)), ppvObject=0x10ff644 | out: ppvObject=0x10ff644*=0x151a620) returned 0x0 [0071.458] IUnknown:Release (This=0x151a620) returned 0x2 [0071.458] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x3541d0 [0071.458] ITrigger:put_Id (This=0x151a620, Id="Trigger1") returned 0x0 [0071.459] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3541d0 | out: hHeap=0x310000) returned 1 [0071.459] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x10ff494 | out: lpSystemTimeAsFileTime=0x10ff494) [0071.459] GetEnvironmentStringsW () returned 0x368b48* [0071.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x565) returned 0x369620 [0071.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x369620, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0071.459] FreeEnvironmentStringsW (penv=0x368b48) returned 1 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x94) returned 0x366810 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1f) returned 0x363b80 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x28) returned 0x34a110 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x37) returned 0x35e108 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3c) returned 0x35cc68 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x31) returned 0x35e0c8 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x35f5c0 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x24) returned 0x34a440 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xd) returned 0x3542c0 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x17) returned 0x35f5e0 [0071.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2b) returned 0x368638 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x15) returned 0x35f460 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x17) returned 0x35f6c0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x22) returned 0x34a140 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x354218 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc1) returned 0x3668b0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3e) returned 0x35ccf8 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1b) returned 0x363c20 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1d) returned 0x363b30 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x48) returned 0x3661c8 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x35f340 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x18) returned 0x35f480 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1b) returned 0x363ba8 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x24) returned 0x34a560 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x29) returned 0x368408 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1e) returned 0x363dd8 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x6b) returned 0x35aca8 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x17) returned 0x35f3a0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xf) returned 0x3541d0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x16) returned 0x35f3e0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x28) returned 0x34a3b0 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x27) returned 0x34a620 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x35f420 [0071.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x21) returned 0x34a680 [0071.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x354128 [0071.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1c) returned 0x363f40 [0071.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x35f440 [0071.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x369620 | out: hHeap=0x310000) returned 1 [0071.461] GetLastError () returned 0x0 [0071.461] SetLastError (dwErrCode=0x0) [0071.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x354218, cbMultiByte=2, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0071.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x354218, cbMultiByte=2, lpWideCharStr=0x10ff1d8, cchWideChar=2 | out: lpWideCharStr="OS\x04") returned 2 [0071.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2d1404, cbMultiByte=2, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0071.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2d1404, cbMultiByte=2, lpWideCharStr=0x10ff1c8, cchWideChar=2 | out: lpWideCharStr="TZ뇥+쳌") returned 2 [0071.462] CompareStringEx (lpLocaleName="en-US", dwCmpFlags=0x1001, lpString1="OS\x04", cchCount1=2, lpString2="TZ뇥+쳌", cchCount2=2, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0) returned 1 [0071.462] GetTimeZoneInformation (in: lpTimeZoneInformation=0x2fda78 | out: lpTimeZoneInformation=0x2fda78) returned 0x2 [0071.462] GetLastError () returned 0x0 [0071.462] SetLastError (dwErrCode=0x0) [0071.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="W. Europe Standard Time", cchWideChar=-1, lpMultiByteStr=0x2f72d0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff338 | out: lpMultiByteStr="W. Europe Standard Time", lpUsedDefaultChar=0x10ff338) returned 24 [0071.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="W. Europe Daylight Time", cchWideChar=-1, lpMultiByteStr=0x2f7310, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x10ff338 | out: lpMultiByteStr="W. Europe Daylight Time", lpUsedDefaultChar=0x10ff338) returned 24 [0071.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x110) returned 0x3663d0 [0071.462] GetLastError () returned 0x0 [0071.463] SetLastError (dwErrCode=0x0) [0071.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2d8548, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0071.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x24) returned 0x34a3e0 [0071.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x2d8548, cbMultiByte=-1, lpWideCharStr=0x34a3e0, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0071.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x208) returned 0x363038 [0071.463] GetLastError () returned 0x0 [0071.463] SetLastError (dwErrCode=0x0) [0071.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2020-10-04T18:37:31", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2020-10-04T18:37:31", cchWideChar=-1, lpMultiByteStr=0x3663d0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2020-10-04T18:37:31", lpUsedDefaultChar=0x0) returned 20 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363038 | out: hHeap=0x310000) returned 1 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x34a3e0 | out: hHeap=0x310000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368248 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3663d0 | out: hHeap=0x310000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x354230 [0071.463] ITrigger:put_StartBoundary (This=0x151a620, StartBoundary="2020-10-04T18:37:31") returned 0x0 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x354230 | out: hHeap=0x310000) returned 1 [0071.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368248 | out: hHeap=0x310000) returned 1 [0071.463] IDailyTrigger:put_DaysInterval (This=0x151a620, DaysInterval=1) returned 0x0 [0071.463] ITrigger:get_Repetition (in: This=0x151a620, ppRepeat=0x10ff640 | out: ppRepeat=0x10ff640*=0x151a678) returned 0x0 [0071.463] IUnknown:Release (This=0x151a620) returned 0x1 [0071.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x354230 [0071.464] IRepetitionPattern:put_Interval (This=0x151a678, Interval="PT10M") returned 0x0 [0071.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x354230 | out: hHeap=0x310000) returned 1 [0071.464] IUnknown:Release (This=0x151a678) returned 0x1 [0071.464] ITaskDefinition:get_Actions (in: This=0x151a378, ppActions=0x10ff630 | out: ppActions=0x10ff630*=0x151a3c8) returned 0x0 [0071.464] IActionCollection:Create (in: This=0x151a3c8, Type=0, ppAction=0x10ff62c | out: ppAction=0x10ff62c*=0x151a6c0) returned 0x0 [0071.464] IUnknown:Release (This=0x151a3c8) returned 0x1 [0071.464] IUnknown:QueryInterface (in: This=0x151a6c0, riid=0x2cd8e4*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x10ff63c | out: ppvObject=0x10ff63c*=0x151a6c0) returned 0x0 [0071.464] IUnknown:Release (This=0x151a6c0) returned 0x2 [0071.464] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x354230 [0071.464] IExecAction:put_Path (This=0x151a6c0, Path="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\BUIRansomSample.exe") returned 0x0 [0071.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x354230 | out: hHeap=0x310000) returned 1 [0071.464] ITaskDefinition:get_Settings (in: This=0x151a378, ppSettings=0x10ff624 | out: ppSettings=0x10ff624*=0x151a480) returned 0x0 [0071.465] ITaskSettings:put_Hidden (This=0x151a480, Hidden=1) returned 0x0 [0071.465] ITaskDefinition:put_Settings (This=0x151a378, Settings=0x151a480) returned 0x0 [0071.465] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x354278 [0071.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d7d6a, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0071.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d7d6a, cbMultiByte=1, lpWideCharStr=0x10ff510, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0071.465] SysStringByteLen (bstr="") returned 0x0 [0071.465] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x353d68 [0071.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d7d6a, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0071.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d7d6a, cbMultiByte=1, lpWideCharStr=0x10ff510, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0071.466] SysStringByteLen (bstr="") returned 0x0 [0071.466] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc) returned 0x353b88 [0071.466] ITaskFolder:RegisterTaskDefinition (in: This=0x151a318, Path="update", pDefinition=0x151a378, flags=6, UserId=0x10ff52c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), password=0x10ff53c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), LogonType=0, sddl=0x10ff550*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), ppTask=0x10ff620 | out: ppTask=0x10ff620*=0x151a730) returned 0x0 [0077.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x353b88 | out: hHeap=0x310000) returned 1 [0077.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x353d68 | out: hHeap=0x310000) returned 1 [0077.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x354278 | out: hHeap=0x310000) returned 1 [0077.292] TaskScheduler:IUnknown:Release (This=0x151a318) returned 0x0 [0077.292] TaskScheduler:IUnknown:Release (This=0x151a378) returned 0x0 [0077.292] IUnknown:Release (This=0x151a730) returned 0x0 [0077.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0077.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361120 | out: hHeap=0x310000) returned 1 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x258) returned 0x361690 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363d10 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363bd0 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363e28 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363d38 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363bf8 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368478 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363ab8 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363c48 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363e50 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367f70 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3680c0 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363e78 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363ec8 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364170 [0077.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3640f8 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3641e8 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3640a8 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364008 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368558 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x258) returned 0x369780 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363fb8 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364120 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3640d0 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364238 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x363fe0 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368050 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364198 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364148 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364030 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368130 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3681a0 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364260 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364058 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364080 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x3641c0 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x364210 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369bf0 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369b50 [0077.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368210 [0077.295] GetTickCount () returned 0x11549c7 [0077.295] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369d08 [0077.296] OpenServiceW (hSCManager=0x369d08, lpServiceName="DefWatch", dwDesiredAccess=0x2c) returned 0x0 [0077.297] CloseServiceHandle (hSCObject=0x369d08) returned 1 [0077.297] GetTickCount () returned 0x11549c7 [0077.297] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e48 [0077.297] OpenServiceW (hSCManager=0x369e48, lpServiceName="ccEvtMgr", dwDesiredAccess=0x2c) returned 0x0 [0077.297] CloseServiceHandle (hSCObject=0x369e48) returned 1 [0077.298] GetTickCount () returned 0x11549c7 [0077.298] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c40 [0077.298] OpenServiceW (hSCManager=0x369c40, lpServiceName="ccSetMgr", dwDesiredAccess=0x2c) returned 0x0 [0077.298] CloseServiceHandle (hSCObject=0x369c40) returned 1 [0077.299] GetTickCount () returned 0x11549d7 [0077.299] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369da8 [0077.299] OpenServiceW (hSCManager=0x369da8, lpServiceName="SavRoam", dwDesiredAccess=0x2c) returned 0x0 [0077.300] CloseServiceHandle (hSCObject=0x369da8) returned 1 [0077.300] GetTickCount () returned 0x11549d7 [0077.300] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e48 [0077.300] OpenServiceW (hSCManager=0x369e48, lpServiceName="dbsrv12", dwDesiredAccess=0x2c) returned 0x0 [0077.300] CloseServiceHandle (hSCObject=0x369e48) returned 1 [0077.301] GetTickCount () returned 0x11549d7 [0077.301] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ee8 [0077.301] OpenServiceW (hSCManager=0x369ee8, lpServiceName="sqlservr", dwDesiredAccess=0x2c) returned 0x0 [0077.301] CloseServiceHandle (hSCObject=0x369ee8) returned 1 [0077.302] GetTickCount () returned 0x11549d7 [0077.302] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ba0 [0077.302] OpenServiceW (hSCManager=0x369ba0, lpServiceName="sqlagent", dwDesiredAccess=0x2c) returned 0x0 [0077.302] CloseServiceHandle (hSCObject=0x369ba0) returned 1 [0077.303] GetTickCount () returned 0x11549d7 [0077.303] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369cb8 [0077.303] OpenServiceW (hSCManager=0x369cb8, lpServiceName="Intuit.QuickBooks.FCS", dwDesiredAccess=0x2c) returned 0x0 [0077.303] CloseServiceHandle (hSCObject=0x369cb8) returned 1 [0077.304] GetTickCount () returned 0x11549d7 [0077.304] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369bc8 [0077.304] OpenServiceW (hSCManager=0x369bc8, lpServiceName="dbeng8", dwDesiredAccess=0x2c) returned 0x0 [0077.304] CloseServiceHandle (hSCObject=0x369bc8) returned 1 [0077.304] GetTickCount () returned 0x11549d7 [0077.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369d30 [0077.305] OpenServiceW (hSCManager=0x369d30, lpServiceName="sqladhlp", dwDesiredAccess=0x2c) returned 0x0 [0077.305] CloseServiceHandle (hSCObject=0x369d30) returned 1 [0077.305] GetTickCount () returned 0x11549d7 [0077.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c90 [0077.306] OpenServiceW (hSCManager=0x369c90, lpServiceName="QBIDPService", dwDesiredAccess=0x2c) returned 0x0 [0077.306] CloseServiceHandle (hSCObject=0x369c90) returned 1 [0077.306] GetTickCount () returned 0x11549d7 [0077.306] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369d08 [0077.307] OpenServiceW (hSCManager=0x369d08, lpServiceName="Culserver", dwDesiredAccess=0x2c) returned 0x0 [0077.307] CloseServiceHandle (hSCObject=0x369d08) returned 1 [0077.307] GetTickCount () returned 0x11549d7 [0077.307] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c40 [0077.309] OpenServiceW (hSCManager=0x369c40, lpServiceName="RTVscan", dwDesiredAccess=0x2c) returned 0x0 [0077.309] CloseServiceHandle (hSCObject=0x369c40) returned 1 [0077.309] GetTickCount () returned 0x11549d7 [0077.309] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369d58 [0077.310] OpenServiceW (hSCManager=0x369d58, lpServiceName="vmware-usbarbitator64", dwDesiredAccess=0x2c) returned 0x0 [0077.310] CloseServiceHandle (hSCObject=0x369d58) returned 1 [0077.310] GetTickCount () returned 0x11549d7 [0077.310] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c90 [0077.311] OpenServiceW (hSCManager=0x369c90, lpServiceName="vmware-converter", dwDesiredAccess=0x2c) returned 0x0 [0077.311] CloseServiceHandle (hSCObject=0x369c90) returned 1 [0077.311] GetTickCount () returned 0x11549d7 [0077.311] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369d58 [0077.311] OpenServiceW (hSCManager=0x369d58, lpServiceName="VMAuthdService", dwDesiredAccess=0x2c) returned 0x0 [0077.312] CloseServiceHandle (hSCObject=0x369d58) returned 1 [0077.312] GetTickCount () returned 0x11549d7 [0077.312] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ce0 [0077.467] OpenServiceW (hSCManager=0x369ce0, lpServiceName="VMnetDHCP", dwDesiredAccess=0x2c) returned 0x0 [0077.468] CloseServiceHandle (hSCObject=0x369ce0) returned 1 [0077.468] GetTickCount () returned 0x1154a73 [0077.468] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ab0 [0077.468] OpenServiceW (hSCManager=0x369ab0, lpServiceName="VMUSBArbService", dwDesiredAccess=0x2c) returned 0x0 [0077.469] CloseServiceHandle (hSCObject=0x369ab0) returned 1 [0077.469] GetTickCount () returned 0x1154a73 [0077.469] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ee8 [0077.469] OpenServiceW (hSCManager=0x369ee8, lpServiceName="VMwareHostd", dwDesiredAccess=0x2c) returned 0x0 [0077.470] CloseServiceHandle (hSCObject=0x369ee8) returned 1 [0077.470] GetTickCount () returned 0x1154a73 [0077.470] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369cb8 [0077.470] OpenServiceW (hSCManager=0x369cb8, lpServiceName="sqlbrowser", dwDesiredAccess=0x2c) returned 0x0 [0077.471] CloseServiceHandle (hSCObject=0x369cb8) returned 1 [0077.471] GetTickCount () returned 0x1154a73 [0077.471] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369dd0 [0077.471] OpenServiceW (hSCManager=0x369dd0, lpServiceName="SQLADHLP", dwDesiredAccess=0x2c) returned 0x0 [0077.471] CloseServiceHandle (hSCObject=0x369dd0) returned 1 [0077.472] GetTickCount () returned 0x1154a73 [0077.472] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c68 [0077.472] OpenServiceW (hSCManager=0x369c68, lpServiceName="sqlwriter", dwDesiredAccess=0x2c) returned 0x0 [0077.472] CloseServiceHandle (hSCObject=0x369c68) returned 1 [0077.473] GetTickCount () returned 0x1154a73 [0077.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e48 [0077.473] OpenServiceW (hSCManager=0x369e48, lpServiceName="msmdsrv", dwDesiredAccess=0x2c) returned 0x0 [0077.473] CloseServiceHandle (hSCObject=0x369e48) returned 1 [0077.474] GetTickCount () returned 0x1154a73 [0077.474] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ba0 [0077.474] OpenServiceW (hSCManager=0x369ba0, lpServiceName="tomcat6", dwDesiredAccess=0x2c) returned 0x0 [0077.474] CloseServiceHandle (hSCObject=0x369ba0) returned 1 [0077.474] GetTickCount () returned 0x1154a73 [0077.474] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ce0 [0077.475] OpenServiceW (hSCManager=0x369ce0, lpServiceName="QBCFMonitorService", dwDesiredAccess=0x2c) returned 0x0 [0077.475] CloseServiceHandle (hSCObject=0x369ce0) returned 1 [0077.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x258) returned 0x36a1e8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369d08 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369d58 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369b00 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369bc8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369e70 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fa8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369c90 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369d30 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369d80 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368088 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3685c8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ab0 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369a88 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ad8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369da8 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369e98 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369c40 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369dd0 [0077.476] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368280 [0077.476] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.492] OpenServiceW (hSCManager=0x369df8, lpServiceName="DefWatch", dwDesiredAccess=0x10020) returned 0x0 [0077.492] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.492] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.493] OpenServiceW (hSCManager=0x369df8, lpServiceName="ccEvtMgr", dwDesiredAccess=0x10020) returned 0x0 [0077.493] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.493] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ec0 [0077.494] OpenServiceW (hSCManager=0x369ec0, lpServiceName="ccSetMgr", dwDesiredAccess=0x10020) returned 0x0 [0077.527] CloseServiceHandle (hSCObject=0x369ec0) returned 1 [0077.527] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369a38 [0077.528] OpenServiceW (hSCManager=0x369a38, lpServiceName="SavRoam", dwDesiredAccess=0x10020) returned 0x0 [0077.528] CloseServiceHandle (hSCObject=0x369a38) returned 1 [0077.528] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369b78 [0077.529] OpenServiceW (hSCManager=0x369b78, lpServiceName="dbsrv12", dwDesiredAccess=0x10020) returned 0x0 [0077.529] CloseServiceHandle (hSCObject=0x369b78) returned 1 [0077.529] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.530] OpenServiceW (hSCManager=0x369df8, lpServiceName="sqlservr", dwDesiredAccess=0x10020) returned 0x0 [0077.530] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.530] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e20 [0077.531] OpenServiceW (hSCManager=0x369e20, lpServiceName="sqlagent", dwDesiredAccess=0x10020) returned 0x0 [0077.531] CloseServiceHandle (hSCObject=0x369e20) returned 1 [0077.531] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c68 [0077.531] OpenServiceW (hSCManager=0x369c68, lpServiceName="Intuit.QuickBooks.FCS", dwDesiredAccess=0x10020) returned 0x0 [0077.532] CloseServiceHandle (hSCObject=0x369c68) returned 1 [0077.532] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.532] OpenServiceW (hSCManager=0x369df8, lpServiceName="dbeng8", dwDesiredAccess=0x10020) returned 0x0 [0077.533] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.533] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369a38 [0077.533] OpenServiceW (hSCManager=0x369a38, lpServiceName="sqladhlp", dwDesiredAccess=0x10020) returned 0x0 [0077.534] CloseServiceHandle (hSCObject=0x369a38) returned 1 [0077.534] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369a38 [0077.534] OpenServiceW (hSCManager=0x369a38, lpServiceName="QBIDPService", dwDesiredAccess=0x10020) returned 0x0 [0077.534] CloseServiceHandle (hSCObject=0x369a38) returned 1 [0077.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.535] OpenServiceW (hSCManager=0x369df8, lpServiceName="Culserver", dwDesiredAccess=0x10020) returned 0x0 [0077.535] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.536] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369df8 [0077.536] OpenServiceW (hSCManager=0x369df8, lpServiceName="RTVscan", dwDesiredAccess=0x10020) returned 0x0 [0077.536] CloseServiceHandle (hSCObject=0x369df8) returned 1 [0077.537] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ec0 [0077.537] OpenServiceW (hSCManager=0x369ec0, lpServiceName="vmware-usbarbitator64", dwDesiredAccess=0x10020) returned 0x0 [0077.537] CloseServiceHandle (hSCObject=0x369ec0) returned 1 [0077.537] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ee8 [0077.538] OpenServiceW (hSCManager=0x369ee8, lpServiceName="vmware-converter", dwDesiredAccess=0x10020) returned 0x0 [0077.538] CloseServiceHandle (hSCObject=0x369ee8) returned 1 [0077.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369b78 [0077.539] OpenServiceW (hSCManager=0x369b78, lpServiceName="VMAuthdService", dwDesiredAccess=0x10020) returned 0x0 [0077.539] CloseServiceHandle (hSCObject=0x369b78) returned 1 [0077.540] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e48 [0077.540] OpenServiceW (hSCManager=0x369e48, lpServiceName="VMnetDHCP", dwDesiredAccess=0x10020) returned 0x0 [0077.540] CloseServiceHandle (hSCObject=0x369e48) returned 1 [0077.541] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369b28 [0077.541] OpenServiceW (hSCManager=0x369b28, lpServiceName="VMUSBArbService", dwDesiredAccess=0x10020) returned 0x0 [0077.541] CloseServiceHandle (hSCObject=0x369b28) returned 1 [0077.542] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c68 [0077.542] OpenServiceW (hSCManager=0x369c68, lpServiceName="VMwareHostd", dwDesiredAccess=0x10020) returned 0x0 [0077.542] CloseServiceHandle (hSCObject=0x369c68) returned 1 [0077.543] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369e20 [0077.543] OpenServiceW (hSCManager=0x369e20, lpServiceName="sqlbrowser", dwDesiredAccess=0x10020) returned 0x0 [0077.543] CloseServiceHandle (hSCObject=0x369e20) returned 1 [0077.543] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369b28 [0077.544] OpenServiceW (hSCManager=0x369b28, lpServiceName="SQLADHLP", dwDesiredAccess=0x10020) returned 0x0 [0077.544] CloseServiceHandle (hSCObject=0x369b28) returned 1 [0077.544] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369a38 [0077.545] OpenServiceW (hSCManager=0x369a38, lpServiceName="sqlwriter", dwDesiredAccess=0x10020) returned 0x0 [0077.545] CloseServiceHandle (hSCObject=0x369a38) returned 1 [0077.545] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369b28 [0077.546] OpenServiceW (hSCManager=0x369b28, lpServiceName="msmdsrv", dwDesiredAccess=0x10020) returned 0x0 [0077.546] CloseServiceHandle (hSCObject=0x369b28) returned 1 [0077.546] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369c68 [0077.547] OpenServiceW (hSCManager=0x369c68, lpServiceName="tomcat6", dwDesiredAccess=0x10020) returned 0x0 [0077.547] CloseServiceHandle (hSCObject=0x369c68) returned 1 [0077.547] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x369ec0 [0077.547] OpenServiceW (hSCManager=0x369ec0, lpServiceName="QBCFMonitorService", dwDesiredAccess=0x10020) returned 0x0 [0077.548] CloseServiceHandle (hSCObject=0x369ec0) returned 1 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x288) returned 0x36a608 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369df8 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369b78 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369e20 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3680f8 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369c68 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369a10 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369cb8 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369e48 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ce0 [0077.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368248 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ec0 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369a38 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ee8 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369a60 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369b28 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369ba0 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369f10 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a1b8 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a0a0 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368600 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a168 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a118 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369f88 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a0f0 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369fd8 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369fb0 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a0c8 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x288) returned 0x36a898 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a140 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a000 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a028 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682b8 [0077.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a190 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a050 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369f38 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36a078 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x369f60 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368360 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36b008 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36afe0 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ab80 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36afb8 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae28 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad38 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36add8 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36af68 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae00 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3683d0 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36b030 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36af18 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae50 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36af90 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36af40 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ab58 [0077.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abf8 [0077.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0077.573] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.574] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.574] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.575] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.575] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.575] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.576] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.576] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.577] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36adb0 | out: hHeap=0x310000) returned 1 [0077.577] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0077.578] GetLastError () returned 0x424 [0077.578] SetLastError (dwErrCode=0x424) [0077.578] GetLastError () returned 0x424 [0077.578] SetLastError (dwErrCode=0x424) [0077.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0077.578] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.578] GetLastError () returned 0x424 [0077.578] SetLastError (dwErrCode=0x424) [0077.578] GetLastError () returned 0x424 [0077.578] SetLastError (dwErrCode=0x424) [0077.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.578] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.579] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.579] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36adb0 | out: hHeap=0x310000) returned 1 [0077.580] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0077.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0077.580] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.581] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.581] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.582] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.582] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.583] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.584] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.584] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.585] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.585] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.586] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.587] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.588] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.588] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.589] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.589] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.590] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.590] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0077.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.591] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.591] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.591] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.591] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.592] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.592] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.592] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.592] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.592] GetLastError () returned 0x424 [0077.592] SetLastError (dwErrCode=0x424) [0077.592] GetLastError () returned 0x424 [0077.592] SetLastError (dwErrCode=0x424) [0077.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.593] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.593] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0077.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c908 [0077.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c908 | out: hHeap=0x310000) returned 1 [0077.594] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0077.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.594] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0077.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.595] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.595] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0077.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.595] GetLastError () returned 0x424 [0077.595] SetLastError (dwErrCode=0x424) [0077.595] GetLastError () returned 0x424 [0077.595] SetLastError (dwErrCode=0x424) [0077.595] GetLastError () returned 0x424 [0077.595] SetLastError (dwErrCode=0x424) [0077.596] GetLastError () returned 0x424 [0077.596] SetLastError (dwErrCode=0x424) [0077.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.596] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0077.596] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.596] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.601] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.601] GetLastError () returned 0x424 [0077.601] SetLastError (dwErrCode=0x424) [0077.601] GetLastError () returned 0x424 [0077.601] SetLastError (dwErrCode=0x424) [0077.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0077.602] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.602] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending_windsor_bouquet.exe")) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cdd0 [0077.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35cdd0 | out: hHeap=0x310000) returned 1 [0077.603] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment.exe")) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.603] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="swing.exe")) returned 1 [0077.604] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.604] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.604] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x380, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature.exe")) returned 1 [0077.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.605] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac98 | out: hHeap=0x310000) returned 1 [0077.605] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="drives aerospace upgrade.exe")) returned 1 [0077.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c7e8 [0077.605] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c7e8 | out: hHeap=0x310000) returned 1 [0077.605] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="competitiveforest.exe")) returned 1 [0077.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.606] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.606] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="approx.exe")) returned 1 [0077.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.607] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="std_look.exe")) returned 1 [0077.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.607] GetLastError () returned 0x424 [0077.607] SetLastError (dwErrCode=0x424) [0077.607] GetLastError () returned 0x424 [0077.607] SetLastError (dwErrCode=0x424) [0077.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.607] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="try.exe")) returned 1 [0077.608] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="polyactuallykent.exe")) returned 1 [0077.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.608] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0077.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.609] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="heating.exe")) returned 1 [0077.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.610] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="hamburg.exe")) returned 1 [0077.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.610] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pads-modules.exe")) returned 1 [0077.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.611] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="deliverymagazine.exe")) returned 1 [0077.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.611] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.612] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.613] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.613] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad88 | out: hHeap=0x310000) returned 1 [0077.614] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.615] GetLastError () returned 0x424 [0077.615] SetLastError (dwErrCode=0x424) [0077.615] GetLastError () returned 0x424 [0077.615] SetLastError (dwErrCode=0x424) [0077.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.615] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac98 | out: hHeap=0x310000) returned 1 [0077.616] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.617] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.618] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.619] GetLastError () returned 0x424 [0077.619] SetLastError (dwErrCode=0x424) [0077.619] GetLastError () returned 0x424 [0077.619] SetLastError (dwErrCode=0x424) [0077.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.619] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.621] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.622] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.622] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.623] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.624] GetLastError () returned 0x424 [0077.624] SetLastError (dwErrCode=0x424) [0077.624] GetLastError () returned 0x424 [0077.624] SetLastError (dwErrCode=0x424) [0077.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.625] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.626] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad88 | out: hHeap=0x310000) returned 1 [0077.626] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.627] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.627] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0077.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.628] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.628] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.630] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.631] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ace8 [0077.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ace8 | out: hHeap=0x310000) returned 1 [0077.631] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.632] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.632] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.632] GetLastError () returned 0x424 [0077.633] SetLastError (dwErrCode=0x424) [0077.633] GetLastError () returned 0x424 [0077.633] SetLastError (dwErrCode=0x424) [0077.633] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.633] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0077.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.634] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.634] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.635] GetLastError () returned 0x424 [0077.635] SetLastError (dwErrCode=0x424) [0077.635] GetLastError () returned 0x424 [0077.635] SetLastError (dwErrCode=0x424) [0077.635] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.635] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.636] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.636] GetLastError () returned 0x424 [0077.636] SetLastError (dwErrCode=0x424) [0077.636] GetLastError () returned 0x424 [0077.636] SetLastError (dwErrCode=0x424) [0077.636] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.636] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.637] GetLastError () returned 0x424 [0077.637] SetLastError (dwErrCode=0x424) [0077.637] GetLastError () returned 0x424 [0077.637] SetLastError (dwErrCode=0x424) [0077.637] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.637] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.638] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.638] GetLastError () returned 0x424 [0077.638] SetLastError (dwErrCode=0x424) [0077.638] GetLastError () returned 0x424 [0077.638] SetLastError (dwErrCode=0x424) [0077.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.638] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.641] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.642] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.643] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.644] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.644] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.645] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.645] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.646] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368520 [0077.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368520 | out: hHeap=0x310000) returned 1 [0077.647] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.648] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.648] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.650] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.651] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.652] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.653] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.653] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.653] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.654] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.654] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.655] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.656] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.656] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.656] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.657] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="client.exe")) returned 1 [0077.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.658] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.658] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="encyclopedia.exe")) returned 1 [0077.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.659] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tiny.exe")) returned 1 [0077.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.660] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.661] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.661] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.661] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.662] GetLastError () returned 0x424 [0077.662] SetLastError (dwErrCode=0x424) [0077.662] GetLastError () returned 0x424 [0077.662] SetLastError (dwErrCode=0x424) [0077.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36adb0 | out: hHeap=0x310000) returned 1 [0077.662] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.663] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0077.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.665] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.666] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0077.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.667] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0077.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.668] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0077.668] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c758 [0077.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c758 | out: hHeap=0x310000) returned 1 [0077.669] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x118c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.669] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0077.669] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x116c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.670] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.670] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.670] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.671] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.671] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.671] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="BUIRansomSample.exe")) returned 1 [0077.671] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.671] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.672] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="BUIRansomSample.exe")) returned 0 [0077.672] CloseHandle (hObject=0x33c) returned 1 [0077.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0077.679] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.682] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.682] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.683] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36adb0 | out: hHeap=0x310000) returned 1 [0077.684] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.684] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.684] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.685] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.685] GetLastError () returned 0x12 [0077.685] SetLastError (dwErrCode=0x12) [0077.685] GetLastError () returned 0x12 [0077.686] SetLastError (dwErrCode=0x12) [0077.686] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad88 | out: hHeap=0x310000) returned 1 [0077.686] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.686] GetLastError () returned 0x12 [0077.686] SetLastError (dwErrCode=0x12) [0077.686] GetLastError () returned 0x12 [0077.686] SetLastError (dwErrCode=0x12) [0077.686] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.686] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.687] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.687] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.688] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.688] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.688] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.688] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.689] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.689] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.690] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.690] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.690] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.691] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.691] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.691] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.691] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.692] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.692] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.692] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.692] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.692] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.693] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.693] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36adb0 | out: hHeap=0x310000) returned 1 [0077.693] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.694] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.694] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.694] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.694] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.695] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.695] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.696] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.696] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.697] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.697] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.698] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.698] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.698] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.698] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0077.699] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.699] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.700] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.700] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.701] GetLastError () returned 0x12 [0077.701] SetLastError (dwErrCode=0x12) [0077.701] GetLastError () returned 0x12 [0077.701] SetLastError (dwErrCode=0x12) [0077.701] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.701] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0077.701] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368590 | out: hHeap=0x310000) returned 1 [0077.701] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0077.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c908 | out: hHeap=0x310000) returned 1 [0077.702] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0077.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.703] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0077.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.703] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0077.704] GetLastError () returned 0x12 [0077.704] SetLastError (dwErrCode=0x12) [0077.704] GetLastError () returned 0x12 [0077.704] SetLastError (dwErrCode=0x12) [0077.704] GetLastError () returned 0x12 [0077.704] SetLastError (dwErrCode=0x12) [0077.704] GetLastError () returned 0x12 [0077.704] SetLastError (dwErrCode=0x12) [0077.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.704] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0077.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.705] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.706] GetLastError () returned 0x12 [0077.706] SetLastError (dwErrCode=0x12) [0077.706] GetLastError () returned 0x12 [0077.706] SetLastError (dwErrCode=0x12) [0077.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.706] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.707] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0077.707] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending_windsor_bouquet.exe")) returned 1 [0077.707] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c998 | out: hHeap=0x310000) returned 1 [0077.707] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment.exe")) returned 1 [0077.708] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.708] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="swing.exe")) returned 1 [0077.708] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.708] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x380, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature.exe")) returned 1 [0077.709] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac98 | out: hHeap=0x310000) returned 1 [0077.709] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="drives aerospace upgrade.exe")) returned 1 [0077.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35cab8 | out: hHeap=0x310000) returned 1 [0077.710] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="competitiveforest.exe")) returned 1 [0077.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.710] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="approx.exe")) returned 1 [0077.711] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.711] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="std_look.exe")) returned 1 [0077.712] GetLastError () returned 0x12 [0077.712] SetLastError (dwErrCode=0x12) [0077.712] GetLastError () returned 0x12 [0077.712] SetLastError (dwErrCode=0x12) [0077.712] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.712] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="try.exe")) returned 1 [0077.712] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="polyactuallykent.exe")) returned 1 [0077.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.713] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0077.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.713] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="heating.exe")) returned 1 [0077.714] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.714] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="hamburg.exe")) returned 1 [0077.714] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.714] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pads-modules.exe")) returned 1 [0077.715] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.715] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="deliverymagazine.exe")) returned 1 [0077.715] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.715] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0077.717] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.718] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.719] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.719] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.720] GetLastError () returned 0x12 [0077.720] SetLastError (dwErrCode=0x12) [0077.720] GetLastError () returned 0x12 [0077.720] SetLastError (dwErrCode=0x12) [0077.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.720] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.721] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.722] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.723] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.723] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.724] GetLastError () returned 0x12 [0077.724] SetLastError (dwErrCode=0x12) [0077.724] GetLastError () returned 0x12 [0077.724] SetLastError (dwErrCode=0x12) [0077.724] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.724] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.725] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.726] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.728] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.729] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.730] GetLastError () returned 0x12 [0077.730] SetLastError (dwErrCode=0x12) [0077.730] GetLastError () returned 0x12 [0077.730] SetLastError (dwErrCode=0x12) [0077.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.730] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.731] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.732] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.732] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.733] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.733] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0077.733] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.733] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.735] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.735] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.736] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.736] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.737] GetLastError () returned 0x12 [0077.737] SetLastError (dwErrCode=0x12) [0077.737] GetLastError () returned 0x12 [0077.737] SetLastError (dwErrCode=0x12) [0077.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.737] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0077.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.738] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.739] GetLastError () returned 0x12 [0077.739] SetLastError (dwErrCode=0x12) [0077.739] GetLastError () returned 0x12 [0077.739] SetLastError (dwErrCode=0x12) [0077.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.739] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.740] GetLastError () returned 0x12 [0077.740] SetLastError (dwErrCode=0x12) [0077.740] GetLastError () returned 0x12 [0077.740] SetLastError (dwErrCode=0x12) [0077.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.740] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.741] GetLastError () returned 0x12 [0077.741] SetLastError (dwErrCode=0x12) [0077.741] GetLastError () returned 0x12 [0077.741] SetLastError (dwErrCode=0x12) [0077.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.741] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.742] GetLastError () returned 0x12 [0077.742] SetLastError (dwErrCode=0x12) [0077.742] GetLastError () returned 0x12 [0077.743] SetLastError (dwErrCode=0x12) [0077.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.743] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad10 | out: hHeap=0x310000) returned 1 [0077.744] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.744] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.745] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.746] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.747] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.748] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.748] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.748] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.748] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.749] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.750] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36abd0 | out: hHeap=0x310000) returned 1 [0077.752] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.753] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.753] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.754] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.755] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.756] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.756] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.757] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0077.758] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="client.exe")) returned 1 [0077.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.760] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="encyclopedia.exe")) returned 1 [0077.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.760] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tiny.exe")) returned 1 [0077.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.761] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.762] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.763] GetLastError () returned 0x12 [0077.763] SetLastError (dwErrCode=0x12) [0077.763] GetLastError () returned 0x12 [0077.763] SetLastError (dwErrCode=0x12) [0077.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.763] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.764] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0077.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.765] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.766] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0077.767] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.767] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0077.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.768] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0077.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c710 | out: hHeap=0x310000) returned 1 [0077.769] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x118c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad88 | out: hHeap=0x310000) returned 1 [0077.770] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x116c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.771] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.771] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.772] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="BUIRansomSample.exe")) returned 1 [0077.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.773] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="BUIRansomSample.exe")) returned 0 [0077.773] CloseHandle (hObject=0x33c) returned 1 [0077.773] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0077.780] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.781] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0077.781] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.781] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.782] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.783] GetLastError () returned 0x12 [0077.783] SetLastError (dwErrCode=0x12) [0077.783] GetLastError () returned 0x12 [0077.783] SetLastError (dwErrCode=0x12) [0077.783] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.783] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.783] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.783] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.784] GetLastError () returned 0x12 [0077.784] SetLastError (dwErrCode=0x12) [0077.784] GetLastError () returned 0x12 [0077.784] SetLastError (dwErrCode=0x12) [0077.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.784] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aec8 | out: hHeap=0x310000) returned 1 [0077.785] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.785] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.786] GetLastError () returned 0x12 [0077.786] SetLastError (dwErrCode=0x12) [0077.786] GetLastError () returned 0x12 [0077.786] SetLastError (dwErrCode=0x12) [0077.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.786] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac98 | out: hHeap=0x310000) returned 1 [0077.786] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.788] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.789] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.790] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.790] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aea0 | out: hHeap=0x310000) returned 1 [0077.790] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.790] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36acc0 | out: hHeap=0x310000) returned 1 [0077.791] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0077.792] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad88 | out: hHeap=0x310000) returned 1 [0077.792] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0077.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0077.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0077.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.794] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.795] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.795] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.795] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac20 | out: hHeap=0x310000) returned 1 [0077.795] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.796] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.796] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac48 | out: hHeap=0x310000) returned 1 [0077.796] Process32NextW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.796] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.796] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.798] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.798] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.799] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.799] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.799] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.799] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.800] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.801] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.801] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0077.802] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0077.802] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0077.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0077.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cdd0 [0077.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35cdd0 | out: hHeap=0x310000) returned 1 [0077.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368328 [0077.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368328 | out: hHeap=0x310000) returned 1 [0077.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0077.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cdd0 [0077.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.809] GetLastError () returned 0x12 [0077.809] SetLastError (dwErrCode=0x12) [0077.809] GetLastError () returned 0x12 [0077.809] SetLastError (dwErrCode=0x12) [0077.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ace8 [0077.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cf38 [0077.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.811] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.811] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.813] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.813] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.814] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.814] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.815] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368520 [0077.815] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.815] GetLastError () returned 0x12 [0077.815] SetLastError (dwErrCode=0x12) [0077.815] GetLastError () returned 0x12 [0077.815] SetLastError (dwErrCode=0x12) [0077.816] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.817] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.817] GetLastError () returned 0x12 [0077.817] SetLastError (dwErrCode=0x12) [0077.817] GetLastError () returned 0x12 [0077.817] SetLastError (dwErrCode=0x12) [0077.817] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.817] GetLastError () returned 0x12 [0077.817] SetLastError (dwErrCode=0x12) [0077.817] GetLastError () returned 0x12 [0077.817] SetLastError (dwErrCode=0x12) [0077.818] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.819] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.824] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.824] GetLastError () returned 0x12 [0077.824] SetLastError (dwErrCode=0x12) [0077.824] GetLastError () returned 0x12 [0077.824] SetLastError (dwErrCode=0x12) [0077.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0077.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.829] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.829] GetLastError () returned 0x12 [0077.829] SetLastError (dwErrCode=0x12) [0077.829] GetLastError () returned 0x12 [0077.829] SetLastError (dwErrCode=0x12) [0077.830] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0077.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.835] GetLastError () returned 0x12 [0077.835] SetLastError (dwErrCode=0x12) [0077.835] GetLastError () returned 0x12 [0077.835] SetLastError (dwErrCode=0x12) [0077.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.839] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.841] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368520 [0077.842] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.843] GetLastError () returned 0x12 [0077.843] SetLastError (dwErrCode=0x12) [0077.843] GetLastError () returned 0x12 [0077.843] SetLastError (dwErrCode=0x12) [0077.844] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.847] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0077.850] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.850] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.854] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.856] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.856] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.857] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ace8 [0077.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.859] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cdd0 [0077.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0077.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.862] CloseHandle (hObject=0x33c) returned 1 [0077.862] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0077.871] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.874] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.874] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.877] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.877] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.883] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0077.886] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.886] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c710 [0077.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.891] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cea8 [0077.891] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cab8 [0077.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.896] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0077.896] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.897] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.897] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0077.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.899] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.899] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.900] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.901] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0077.902] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36adb0 [0077.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0077.907] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0077.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac48 [0077.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ace8 [0077.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0077.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0077.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac98 [0077.927] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.928] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0077.928] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368520 [0077.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368018 [0077.930] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0077.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.934] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0077.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0077.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.940] GetLastError () returned 0x12 [0077.940] SetLastError (dwErrCode=0x12) [0077.940] GetLastError () returned 0x12 [0077.940] SetLastError (dwErrCode=0x12) [0077.941] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0077.942] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c998 [0077.942] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0077.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0077.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0077.945] CloseHandle (hObject=0x33c) returned 1 [0077.945] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.007] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.010] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0078.011] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0078.012] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.012] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0078.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0078.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0078.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0078.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad10 [0078.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0078.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0078.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0078.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0078.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36abd0 [0078.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0078.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aea0 [0078.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0078.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0078.022] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.022] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.023] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0078.023] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36acc0 [0078.024] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aec8 [0078.024] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0078.024] GetLastError () returned 0x12 [0078.024] SetLastError (dwErrCode=0x12) [0078.024] GetLastError () returned 0x12 [0078.024] SetLastError (dwErrCode=0x12) [0078.025] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0078.025] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0078.026] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cdd0 [0078.026] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0078.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0078.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac20 [0078.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0078.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0078.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35c710 [0078.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.030] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad88 [0078.030] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.031] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x35cea8 [0078.031] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368328 [0078.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0078.041] SetLastError (dwErrCode=0x12) [0078.041] GetLastError () returned 0x12 [0078.041] SetLastError (dwErrCode=0x12) [0078.048] SetLastError (dwErrCode=0x12) [0078.048] GetLastError () returned 0x12 [0078.048] SetLastError (dwErrCode=0x12) [0078.050] SetLastError (dwErrCode=0x12) [0078.050] GetLastError () returned 0x12 [0078.050] SetLastError (dwErrCode=0x12) [0078.076] SetLastError (dwErrCode=0x12) [0078.076] GetLastError () returned 0x12 [0078.076] SetLastError (dwErrCode=0x12) [0078.077] SetLastError (dwErrCode=0x12) [0078.077] GetLastError () returned 0x12 [0078.077] SetLastError (dwErrCode=0x12) [0078.078] SetLastError (dwErrCode=0x12) [0078.078] GetLastError () returned 0x12 [0078.078] SetLastError (dwErrCode=0x12) [0078.089] CloseHandle (hObject=0x33c) returned 1 [0078.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.097] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.121] SetLastError (dwErrCode=0x12) [0078.121] GetLastError () returned 0x12 [0078.121] SetLastError (dwErrCode=0x12) [0078.129] SetLastError (dwErrCode=0x12) [0078.129] GetLastError () returned 0x12 [0078.129] SetLastError (dwErrCode=0x12) [0078.130] SetLastError (dwErrCode=0x12) [0078.130] GetLastError () returned 0x12 [0078.130] SetLastError (dwErrCode=0x12) [0078.175] SetLastError (dwErrCode=0x12) [0078.175] GetLastError () returned 0x12 [0078.175] SetLastError (dwErrCode=0x12) [0078.191] SetLastError (dwErrCode=0x12) [0078.191] GetLastError () returned 0x12 [0078.192] SetLastError (dwErrCode=0x12) [0078.196] SetLastError (dwErrCode=0x12) [0078.196] GetLastError () returned 0x12 [0078.196] SetLastError (dwErrCode=0x12) [0078.200] SetLastError (dwErrCode=0x12) [0078.200] GetLastError () returned 0x12 [0078.200] SetLastError (dwErrCode=0x12) [0078.201] SetLastError (dwErrCode=0x12) [0078.201] GetLastError () returned 0x12 [0078.201] SetLastError (dwErrCode=0x12) [0078.204] SetLastError (dwErrCode=0x12) [0078.204] GetLastError () returned 0x12 [0078.204] SetLastError (dwErrCode=0x12) [0078.206] SetLastError (dwErrCode=0x12) [0078.206] GetLastError () returned 0x12 [0078.206] SetLastError (dwErrCode=0x12) [0078.217] CloseHandle (hObject=0x33c) returned 1 [0078.218] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.226] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.228] SetLastError (dwErrCode=0x12) [0078.228] GetLastError () returned 0x12 [0078.238] SetLastError (dwErrCode=0x12) [0078.241] SetLastError (dwErrCode=0x12) [0078.241] GetLastError () returned 0x12 [0078.241] SetLastError (dwErrCode=0x12) [0078.242] SetLastError (dwErrCode=0x12) [0078.243] GetLastError () returned 0x12 [0078.243] SetLastError (dwErrCode=0x12) [0078.244] SetLastError (dwErrCode=0x12) [0078.244] GetLastError () returned 0x12 [0078.244] SetLastError (dwErrCode=0x12) [0078.246] SetLastError (dwErrCode=0x12) [0078.246] GetLastError () returned 0x12 [0078.246] SetLastError (dwErrCode=0x12) [0078.246] SetLastError (dwErrCode=0x12) [0078.246] GetLastError () returned 0x12 [0078.246] SetLastError (dwErrCode=0x12) [0078.247] SetLastError (dwErrCode=0x12) [0078.247] GetLastError () returned 0x12 [0078.247] SetLastError (dwErrCode=0x12) [0078.247] SetLastError (dwErrCode=0x12) [0078.247] GetLastError () returned 0x12 [0078.248] SetLastError (dwErrCode=0x12) [0078.248] SetLastError (dwErrCode=0x12) [0078.248] GetLastError () returned 0x12 [0078.248] SetLastError (dwErrCode=0x12) [0078.249] SetLastError (dwErrCode=0x12) [0078.249] GetLastError () returned 0x12 [0078.249] SetLastError (dwErrCode=0x12) [0078.249] SetLastError (dwErrCode=0x12) [0078.249] GetLastError () returned 0x12 [0078.249] SetLastError (dwErrCode=0x12) [0078.250] SetLastError (dwErrCode=0x12) [0078.250] GetLastError () returned 0x12 [0078.250] SetLastError (dwErrCode=0x12) [0078.251] SetLastError (dwErrCode=0x12) [0078.251] GetLastError () returned 0x12 [0078.251] SetLastError (dwErrCode=0x12) [0078.251] SetLastError (dwErrCode=0x12) [0078.251] GetLastError () returned 0x12 [0078.251] SetLastError (dwErrCode=0x12) [0078.252] SetLastError (dwErrCode=0x12) [0078.252] GetLastError () returned 0x12 [0078.252] SetLastError (dwErrCode=0x12) [0078.253] SetLastError (dwErrCode=0x12) [0078.253] GetLastError () returned 0x12 [0078.253] SetLastError (dwErrCode=0x12) [0078.254] SetLastError (dwErrCode=0x12) [0078.254] GetLastError () returned 0x12 [0078.254] SetLastError (dwErrCode=0x12) [0078.259] SetLastError (dwErrCode=0x12) [0078.259] GetLastError () returned 0x12 [0078.259] SetLastError (dwErrCode=0x12) [0078.267] SetLastError (dwErrCode=0x12) [0078.268] GetLastError () returned 0x12 [0078.268] SetLastError (dwErrCode=0x12) [0078.268] SetLastError (dwErrCode=0x12) [0078.268] GetLastError () returned 0x12 [0078.268] SetLastError (dwErrCode=0x12) [0078.272] SetLastError (dwErrCode=0x12) [0078.272] GetLastError () returned 0x12 [0078.272] SetLastError (dwErrCode=0x12) [0078.272] GetLastError () returned 0x12 [0078.272] SetLastError (dwErrCode=0x12) [0078.272] GetLastError () returned 0x12 [0078.272] SetLastError (dwErrCode=0x12) [0078.281] SetLastError (dwErrCode=0x12) [0078.281] GetLastError () returned 0x12 [0078.281] SetLastError (dwErrCode=0x12) [0078.283] SetLastError (dwErrCode=0x12) [0078.283] GetLastError () returned 0x12 [0078.283] SetLastError (dwErrCode=0x12) [0078.294] SetLastError (dwErrCode=0x12) [0078.294] GetLastError () returned 0x12 [0078.294] SetLastError (dwErrCode=0x12) [0078.301] SetLastError (dwErrCode=0x12) [0078.301] GetLastError () returned 0x12 [0078.301] SetLastError (dwErrCode=0x12) [0078.305] SetLastError (dwErrCode=0x12) [0078.305] GetLastError () returned 0x12 [0078.305] SetLastError (dwErrCode=0x12) [0078.312] SetLastError (dwErrCode=0x12) [0078.312] GetLastError () returned 0x12 [0078.312] SetLastError (dwErrCode=0x12) [0078.312] GetLastError () returned 0x12 [0078.312] SetLastError (dwErrCode=0x12) [0078.312] GetLastError () returned 0x12 [0078.312] SetLastError (dwErrCode=0x12) [0078.313] SetLastError (dwErrCode=0x12) [0078.313] GetLastError () returned 0x12 [0078.313] SetLastError (dwErrCode=0x12) [0078.313] GetLastError () returned 0x12 [0078.313] SetLastError (dwErrCode=0x12) [0078.313] GetLastError () returned 0x12 [0078.313] SetLastError (dwErrCode=0x12) [0078.314] SetLastError (dwErrCode=0x12) [0078.314] GetLastError () returned 0x12 [0078.314] SetLastError (dwErrCode=0x12) [0078.315] CloseHandle (hObject=0x33c) returned 1 [0078.315] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.322] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.474] SetLastError (dwErrCode=0x12) [0078.475] GetLastError () returned 0x12 [0078.475] SetLastError (dwErrCode=0x12) [0078.477] SetLastError (dwErrCode=0x12) [0078.477] GetLastError () returned 0x12 [0078.477] SetLastError (dwErrCode=0x12) [0078.478] SetLastError (dwErrCode=0x12) [0078.478] GetLastError () returned 0x12 [0078.478] SetLastError (dwErrCode=0x12) [0078.479] SetLastError (dwErrCode=0x12) [0078.479] GetLastError () returned 0x12 [0078.479] SetLastError (dwErrCode=0x12) [0078.479] SetLastError (dwErrCode=0x12) [0078.479] GetLastError () returned 0x12 [0078.480] SetLastError (dwErrCode=0x12) [0078.480] SetLastError (dwErrCode=0x12) [0078.480] GetLastError () returned 0x12 [0078.480] SetLastError (dwErrCode=0x12) [0078.480] SetLastError (dwErrCode=0x12) [0078.480] GetLastError () returned 0x12 [0078.481] SetLastError (dwErrCode=0x12) [0078.481] SetLastError (dwErrCode=0x12) [0078.481] GetLastError () returned 0x12 [0078.481] SetLastError (dwErrCode=0x12) [0078.481] SetLastError (dwErrCode=0x12) [0078.481] GetLastError () returned 0x12 [0078.481] SetLastError (dwErrCode=0x12) [0078.482] SetLastError (dwErrCode=0x12) [0078.482] GetLastError () returned 0x12 [0078.482] SetLastError (dwErrCode=0x12) [0078.482] SetLastError (dwErrCode=0x12) [0078.482] GetLastError () returned 0x12 [0078.482] SetLastError (dwErrCode=0x12) [0078.483] SetLastError (dwErrCode=0x12) [0078.483] GetLastError () returned 0x12 [0078.483] SetLastError (dwErrCode=0x12) [0078.483] SetLastError (dwErrCode=0x12) [0078.483] GetLastError () returned 0x12 [0078.483] SetLastError (dwErrCode=0x12) [0078.484] SetLastError (dwErrCode=0x12) [0078.484] GetLastError () returned 0x12 [0078.484] SetLastError (dwErrCode=0x12) [0078.484] SetLastError (dwErrCode=0x12) [0078.484] GetLastError () returned 0x12 [0078.484] SetLastError (dwErrCode=0x12) [0078.485] SetLastError (dwErrCode=0x12) [0078.485] GetLastError () returned 0x12 [0078.485] SetLastError (dwErrCode=0x12) [0078.486] SetLastError (dwErrCode=0x12) [0078.486] GetLastError () returned 0x12 [0078.486] SetLastError (dwErrCode=0x12) [0078.490] SetLastError (dwErrCode=0x12) [0078.490] GetLastError () returned 0x12 [0078.490] SetLastError (dwErrCode=0x12) [0078.497] SetLastError (dwErrCode=0x12) [0078.497] GetLastError () returned 0x12 [0078.497] SetLastError (dwErrCode=0x12) [0078.497] SetLastError (dwErrCode=0x12) [0078.498] GetLastError () returned 0x12 [0078.498] SetLastError (dwErrCode=0x12) [0078.501] SetLastError (dwErrCode=0x12) [0078.501] GetLastError () returned 0x12 [0078.502] SetLastError (dwErrCode=0x12) [0078.509] SetLastError (dwErrCode=0x12) [0078.509] GetLastError () returned 0x12 [0078.509] SetLastError (dwErrCode=0x12) [0078.516] SetLastError (dwErrCode=0x12) [0078.516] GetLastError () returned 0x12 [0078.516] SetLastError (dwErrCode=0x12) [0078.525] SetLastError (dwErrCode=0x12) [0078.525] GetLastError () returned 0x12 [0078.525] SetLastError (dwErrCode=0x12) [0078.533] SetLastError (dwErrCode=0x12) [0078.533] GetLastError () returned 0x12 [0078.533] SetLastError (dwErrCode=0x12) [0078.536] SetLastError (dwErrCode=0x12) [0078.537] GetLastError () returned 0x12 [0078.537] SetLastError (dwErrCode=0x12) [0078.541] SetLastError (dwErrCode=0x12) [0078.541] GetLastError () returned 0x12 [0078.541] SetLastError (dwErrCode=0x12) [0078.542] SetLastError (dwErrCode=0x12) [0078.542] GetLastError () returned 0x12 [0078.542] SetLastError (dwErrCode=0x12) [0078.542] SetLastError (dwErrCode=0x12) [0078.542] GetLastError () returned 0x12 [0078.542] SetLastError (dwErrCode=0x12) [0078.543] CloseHandle (hObject=0x33c) returned 1 [0078.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.550] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.553] SetLastError (dwErrCode=0x12) [0078.553] GetLastError () returned 0x12 [0078.553] SetLastError (dwErrCode=0x12) [0078.553] SetLastError (dwErrCode=0x12) [0078.553] GetLastError () returned 0x12 [0078.553] SetLastError (dwErrCode=0x12) [0078.591] SetLastError (dwErrCode=0x12) [0078.591] GetLastError () returned 0x12 [0078.591] SetLastError (dwErrCode=0x12) [0078.594] SetLastError (dwErrCode=0x12) [0078.594] GetLastError () returned 0x12 [0078.594] SetLastError (dwErrCode=0x12) [0078.595] SetLastError (dwErrCode=0x12) [0078.595] GetLastError () returned 0x12 [0078.595] SetLastError (dwErrCode=0x12) [0078.599] SetLastError (dwErrCode=0x12) [0078.599] GetLastError () returned 0x12 [0078.599] SetLastError (dwErrCode=0x12) [0078.690] SetLastError (dwErrCode=0x12) [0078.690] GetLastError () returned 0x12 [0078.690] SetLastError (dwErrCode=0x12) [0078.694] SetLastError (dwErrCode=0x12) [0078.694] GetLastError () returned 0x12 [0078.694] SetLastError (dwErrCode=0x12) [0078.699] SetLastError (dwErrCode=0x12) [0078.699] GetLastError () returned 0x12 [0078.699] SetLastError (dwErrCode=0x12) [0078.705] SetLastError (dwErrCode=0x12) [0078.705] GetLastError () returned 0x12 [0078.705] SetLastError (dwErrCode=0x12) [0078.707] SetLastError (dwErrCode=0x12) [0078.707] GetLastError () returned 0x12 [0078.707] SetLastError (dwErrCode=0x12) [0078.708] SetLastError (dwErrCode=0x12) [0078.708] GetLastError () returned 0x12 [0078.708] SetLastError (dwErrCode=0x12) [0078.709] SetLastError (dwErrCode=0x12) [0078.709] GetLastError () returned 0x12 [0078.709] SetLastError (dwErrCode=0x12) [0078.709] SetLastError (dwErrCode=0x12) [0078.709] GetLastError () returned 0x12 [0078.709] SetLastError (dwErrCode=0x12) [0078.735] SetLastError (dwErrCode=0x12) [0078.736] GetLastError () returned 0x12 [0078.736] SetLastError (dwErrCode=0x12) [0078.742] CloseHandle (hObject=0x33c) returned 1 [0078.742] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0078.750] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.751] SetLastError (dwErrCode=0x12) [0078.751] GetLastError () returned 0x12 [0078.751] SetLastError (dwErrCode=0x12) [0078.820] SetLastError (dwErrCode=0x12) [0078.820] GetLastError () returned 0x12 [0078.820] SetLastError (dwErrCode=0x12) [0078.851] SetLastError (dwErrCode=0x12) [0078.851] GetLastError () returned 0x12 [0078.851] SetLastError (dwErrCode=0x12) [0079.003] SetLastError (dwErrCode=0x12) [0079.003] GetLastError () returned 0x12 [0079.003] SetLastError (dwErrCode=0x12) [0079.008] SetLastError (dwErrCode=0x12) [0079.008] GetLastError () returned 0x12 [0079.008] SetLastError (dwErrCode=0x12) [0079.013] CloseHandle (hObject=0x33c) returned 1 [0079.013] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0079.022] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.104] SetLastError (dwErrCode=0x12) [0079.104] GetLastError () returned 0x12 [0079.104] SetLastError (dwErrCode=0x12) [0079.133] SetLastError (dwErrCode=0x12) [0079.133] GetLastError () returned 0x12 [0079.133] SetLastError (dwErrCode=0x12) [0079.221] CloseHandle (hObject=0x33c) returned 1 [0079.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0079.235] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.238] SetLastError (dwErrCode=0x12) [0079.238] GetLastError () returned 0x12 [0079.238] SetLastError (dwErrCode=0x12) [0079.241] SetLastError (dwErrCode=0x12) [0079.241] GetLastError () returned 0x12 [0079.241] SetLastError (dwErrCode=0x12) [0079.243] SetLastError (dwErrCode=0x12) [0079.243] GetLastError () returned 0x12 [0079.243] SetLastError (dwErrCode=0x12) [0079.244] SetLastError (dwErrCode=0x12) [0079.244] GetLastError () returned 0x12 [0079.244] SetLastError (dwErrCode=0x12) [0079.327] SetLastError (dwErrCode=0x12) [0079.327] GetLastError () returned 0x12 [0079.327] SetLastError (dwErrCode=0x12) [0079.327] SetLastError (dwErrCode=0x12) [0079.327] GetLastError () returned 0x12 [0079.327] SetLastError (dwErrCode=0x12) [0079.328] SetLastError (dwErrCode=0x12) [0079.328] GetLastError () returned 0x12 [0079.328] SetLastError (dwErrCode=0x12) [0079.328] SetLastError (dwErrCode=0x12) [0079.328] GetLastError () returned 0x12 [0079.329] SetLastError (dwErrCode=0x12) [0079.329] SetLastError (dwErrCode=0x12) [0079.329] GetLastError () returned 0x12 [0079.329] SetLastError (dwErrCode=0x12) [0079.330] SetLastError (dwErrCode=0x12) [0079.330] GetLastError () returned 0x12 [0079.330] SetLastError (dwErrCode=0x12) [0079.330] SetLastError (dwErrCode=0x12) [0079.330] GetLastError () returned 0x12 [0079.330] SetLastError (dwErrCode=0x12) [0079.331] SetLastError (dwErrCode=0x12) [0079.331] GetLastError () returned 0x12 [0079.331] SetLastError (dwErrCode=0x12) [0079.331] SetLastError (dwErrCode=0x12) [0079.331] GetLastError () returned 0x12 [0079.331] SetLastError (dwErrCode=0x12) [0079.332] SetLastError (dwErrCode=0x12) [0079.332] GetLastError () returned 0x12 [0079.332] SetLastError (dwErrCode=0x12) [0079.332] SetLastError (dwErrCode=0x12) [0079.332] GetLastError () returned 0x12 [0079.332] SetLastError (dwErrCode=0x12) [0079.333] SetLastError (dwErrCode=0x12) [0079.333] GetLastError () returned 0x12 [0079.333] SetLastError (dwErrCode=0x12) [0079.334] SetLastError (dwErrCode=0x12) [0079.334] GetLastError () returned 0x12 [0079.334] SetLastError (dwErrCode=0x12) [0079.338] SetLastError (dwErrCode=0x12) [0079.338] GetLastError () returned 0x12 [0079.338] SetLastError (dwErrCode=0x12) [0079.343] SetLastError (dwErrCode=0x12) [0079.343] GetLastError () returned 0x12 [0079.343] SetLastError (dwErrCode=0x12) [0079.344] SetLastError (dwErrCode=0x12) [0079.344] GetLastError () returned 0x12 [0079.344] SetLastError (dwErrCode=0x12) [0079.348] SetLastError (dwErrCode=0x12) [0079.348] GetLastError () returned 0x12 [0079.348] SetLastError (dwErrCode=0x12) [0079.357] SetLastError (dwErrCode=0x12) [0079.357] GetLastError () returned 0x12 [0079.357] SetLastError (dwErrCode=0x12) [0079.359] SetLastError (dwErrCode=0x12) [0079.359] GetLastError () returned 0x12 [0079.359] SetLastError (dwErrCode=0x12) [0079.368] SetLastError (dwErrCode=0x12) [0079.368] GetLastError () returned 0x12 [0079.368] SetLastError (dwErrCode=0x12) [0079.492] SetLastError (dwErrCode=0x12) [0079.492] GetLastError () returned 0x12 [0079.492] SetLastError (dwErrCode=0x12) [0079.497] SetLastError (dwErrCode=0x12) [0079.497] GetLastError () returned 0x12 [0079.497] SetLastError (dwErrCode=0x12) [0079.501] SetLastError (dwErrCode=0x12) [0079.501] GetLastError () returned 0x12 [0079.501] SetLastError (dwErrCode=0x12) [0079.501] SetLastError (dwErrCode=0x12) [0079.502] GetLastError () returned 0x12 [0079.502] SetLastError (dwErrCode=0x12) [0079.502] SetLastError (dwErrCode=0x12) [0079.502] GetLastError () returned 0x12 [0079.502] SetLastError (dwErrCode=0x12) [0079.504] CloseHandle (hObject=0x33c) returned 1 [0079.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0079.511] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.644] SetLastError (dwErrCode=0x12) [0079.644] GetLastError () returned 0x12 [0079.644] SetLastError (dwErrCode=0x12) [0079.726] SetLastError (dwErrCode=0x12) [0079.726] GetLastError () returned 0x12 [0079.726] SetLastError (dwErrCode=0x12) [0079.727] SetLastError (dwErrCode=0x12) [0079.727] GetLastError () returned 0x12 [0079.727] SetLastError (dwErrCode=0x12) [0079.748] SetLastError (dwErrCode=0x12) [0079.748] GetLastError () returned 0x12 [0079.748] SetLastError (dwErrCode=0x12) [0079.756] SetLastError (dwErrCode=0x12) [0079.756] GetLastError () returned 0x12 [0079.756] SetLastError (dwErrCode=0x12) [0079.819] SetLastError (dwErrCode=0x12) [0079.819] GetLastError () returned 0x12 [0079.819] SetLastError (dwErrCode=0x12) [0079.822] SetLastError (dwErrCode=0x12) [0079.822] GetLastError () returned 0x12 [0079.822] SetLastError (dwErrCode=0x12) [0079.824] SetLastError (dwErrCode=0x12) [0079.824] GetLastError () returned 0x12 [0079.824] SetLastError (dwErrCode=0x12) [0079.826] SetLastError (dwErrCode=0x12) [0079.826] GetLastError () returned 0x12 [0079.826] SetLastError (dwErrCode=0x12) [0079.828] SetLastError (dwErrCode=0x12) [0079.828] GetLastError () returned 0x12 [0079.828] SetLastError (dwErrCode=0x12) [0079.838] SetLastError (dwErrCode=0x12) [0079.838] GetLastError () returned 0x12 [0079.839] SetLastError (dwErrCode=0x12) [0079.840] CloseHandle (hObject=0x33c) returned 1 [0079.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0079.848] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.850] SetLastError (dwErrCode=0x12) [0079.850] GetLastError () returned 0x12 [0079.851] SetLastError (dwErrCode=0x12) [0079.852] SetLastError (dwErrCode=0x12) [0079.852] GetLastError () returned 0x12 [0079.852] SetLastError (dwErrCode=0x12) [0079.853] SetLastError (dwErrCode=0x12) [0079.853] GetLastError () returned 0x12 [0079.853] SetLastError (dwErrCode=0x12) [0079.876] SetLastError (dwErrCode=0x12) [0079.876] GetLastError () returned 0x12 [0079.876] SetLastError (dwErrCode=0x12) [0079.882] SetLastError (dwErrCode=0x12) [0079.882] GetLastError () returned 0x12 [0079.883] SetLastError (dwErrCode=0x12) [0079.884] SetLastError (dwErrCode=0x12) [0079.884] GetLastError () returned 0x12 [0079.884] SetLastError (dwErrCode=0x12) [0079.884] SetLastError (dwErrCode=0x12) [0079.884] GetLastError () returned 0x12 [0079.884] SetLastError (dwErrCode=0x12) [0079.890] SetLastError (dwErrCode=0x12) [0079.890] GetLastError () returned 0x12 [0079.890] SetLastError (dwErrCode=0x12) [0079.895] SetLastError (dwErrCode=0x12) [0079.895] GetLastError () returned 0x12 [0079.895] SetLastError (dwErrCode=0x12) [0079.912] SetLastError (dwErrCode=0x12) [0079.912] GetLastError () returned 0x12 [0079.912] SetLastError (dwErrCode=0x12) [0079.921] SetLastError (dwErrCode=0x12) [0079.921] GetLastError () returned 0x12 [0079.921] SetLastError (dwErrCode=0x12) [0079.941] CloseHandle (hObject=0x33c) returned 1 [0079.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0079.950] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.953] SetLastError (dwErrCode=0x12) [0079.953] GetLastError () returned 0x12 [0079.953] SetLastError (dwErrCode=0x12) [0079.956] SetLastError (dwErrCode=0x12) [0079.956] GetLastError () returned 0x12 [0079.956] SetLastError (dwErrCode=0x12) [0079.957] SetLastError (dwErrCode=0x12) [0079.957] GetLastError () returned 0x12 [0079.957] SetLastError (dwErrCode=0x12) [0079.958] SetLastError (dwErrCode=0x12) [0079.958] GetLastError () returned 0x12 [0079.958] SetLastError (dwErrCode=0x12) [0079.959] SetLastError (dwErrCode=0x12) [0079.959] GetLastError () returned 0x12 [0079.959] SetLastError (dwErrCode=0x12) [0079.959] SetLastError (dwErrCode=0x12) [0079.959] GetLastError () returned 0x12 [0079.960] SetLastError (dwErrCode=0x12) [0079.960] SetLastError (dwErrCode=0x12) [0079.960] GetLastError () returned 0x12 [0079.960] SetLastError (dwErrCode=0x12) [0079.961] SetLastError (dwErrCode=0x12) [0079.961] GetLastError () returned 0x12 [0079.961] SetLastError (dwErrCode=0x12) [0079.961] SetLastError (dwErrCode=0x12) [0079.961] GetLastError () returned 0x12 [0079.961] SetLastError (dwErrCode=0x12) [0079.962] SetLastError (dwErrCode=0x12) [0079.962] GetLastError () returned 0x12 [0079.962] SetLastError (dwErrCode=0x12) [0079.963] SetLastError (dwErrCode=0x12) [0079.963] GetLastError () returned 0x12 [0079.963] SetLastError (dwErrCode=0x12) [0080.018] SetLastError (dwErrCode=0x12) [0080.018] GetLastError () returned 0x12 [0080.018] SetLastError (dwErrCode=0x12) [0080.018] SetLastError (dwErrCode=0x12) [0080.019] GetLastError () returned 0x12 [0080.019] SetLastError (dwErrCode=0x12) [0080.019] SetLastError (dwErrCode=0x12) [0080.019] GetLastError () returned 0x12 [0080.019] SetLastError (dwErrCode=0x12) [0080.020] SetLastError (dwErrCode=0x12) [0080.020] GetLastError () returned 0x12 [0080.020] SetLastError (dwErrCode=0x12) [0080.020] SetLastError (dwErrCode=0x12) [0080.020] GetLastError () returned 0x12 [0080.020] SetLastError (dwErrCode=0x12) [0080.021] SetLastError (dwErrCode=0x12) [0080.021] GetLastError () returned 0x12 [0080.022] SetLastError (dwErrCode=0x12) [0080.027] SetLastError (dwErrCode=0x12) [0080.027] GetLastError () returned 0x12 [0080.027] SetLastError (dwErrCode=0x12) [0080.033] SetLastError (dwErrCode=0x12) [0080.033] GetLastError () returned 0x12 [0080.033] SetLastError (dwErrCode=0x12) [0080.033] SetLastError (dwErrCode=0x12) [0080.033] GetLastError () returned 0x12 [0080.033] SetLastError (dwErrCode=0x12) [0080.038] SetLastError (dwErrCode=0x12) [0080.038] GetLastError () returned 0x12 [0080.038] SetLastError (dwErrCode=0x12) [0080.049] SetLastError (dwErrCode=0x12) [0080.049] GetLastError () returned 0x12 [0080.049] SetLastError (dwErrCode=0x12) [0080.051] SetLastError (dwErrCode=0x12) [0080.051] GetLastError () returned 0x12 [0080.051] SetLastError (dwErrCode=0x12) [0080.063] SetLastError (dwErrCode=0x12) [0080.063] GetLastError () returned 0x12 [0080.063] SetLastError (dwErrCode=0x12) [0080.071] SetLastError (dwErrCode=0x12) [0080.071] GetLastError () returned 0x12 [0080.071] SetLastError (dwErrCode=0x12) [0080.076] SetLastError (dwErrCode=0x12) [0080.076] GetLastError () returned 0x12 [0080.076] SetLastError (dwErrCode=0x12) [0080.081] SetLastError (dwErrCode=0x12) [0080.081] GetLastError () returned 0x12 [0080.081] SetLastError (dwErrCode=0x12) [0080.082] SetLastError (dwErrCode=0x12) [0080.082] GetLastError () returned 0x12 [0080.082] SetLastError (dwErrCode=0x12) [0080.082] SetLastError (dwErrCode=0x12) [0080.082] GetLastError () returned 0x12 [0080.083] SetLastError (dwErrCode=0x12) [0080.084] CloseHandle (hObject=0x33c) returned 1 [0080.084] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.099] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.102] SetLastError (dwErrCode=0x12) [0080.102] GetLastError () returned 0x12 [0080.102] SetLastError (dwErrCode=0x12) [0080.103] SetLastError (dwErrCode=0x12) [0080.103] GetLastError () returned 0x12 [0080.103] SetLastError (dwErrCode=0x12) [0080.114] SetLastError (dwErrCode=0x12) [0080.115] GetLastError () returned 0x12 [0080.115] SetLastError (dwErrCode=0x12) [0080.117] SetLastError (dwErrCode=0x12) [0080.117] GetLastError () returned 0x12 [0080.117] SetLastError (dwErrCode=0x12) [0080.118] SetLastError (dwErrCode=0x12) [0080.118] GetLastError () returned 0x12 [0080.118] SetLastError (dwErrCode=0x12) [0080.123] SetLastError (dwErrCode=0x12) [0080.123] GetLastError () returned 0x12 [0080.123] SetLastError (dwErrCode=0x12) [0080.130] SetLastError (dwErrCode=0x12) [0080.130] GetLastError () returned 0x12 [0080.130] SetLastError (dwErrCode=0x12) [0080.134] SetLastError (dwErrCode=0x12) [0080.134] GetLastError () returned 0x12 [0080.134] SetLastError (dwErrCode=0x12) [0080.157] SetLastError (dwErrCode=0x12) [0080.157] GetLastError () returned 0x12 [0080.157] SetLastError (dwErrCode=0x12) [0080.164] SetLastError (dwErrCode=0x12) [0080.164] GetLastError () returned 0x12 [0080.164] SetLastError (dwErrCode=0x12) [0080.166] SetLastError (dwErrCode=0x12) [0080.166] GetLastError () returned 0x12 [0080.166] SetLastError (dwErrCode=0x12) [0080.167] SetLastError (dwErrCode=0x12) [0080.167] GetLastError () returned 0x12 [0080.167] SetLastError (dwErrCode=0x12) [0080.168] SetLastError (dwErrCode=0x12) [0080.168] GetLastError () returned 0x12 [0080.168] SetLastError (dwErrCode=0x12) [0080.169] SetLastError (dwErrCode=0x12) [0080.169] GetLastError () returned 0x12 [0080.169] SetLastError (dwErrCode=0x12) [0080.186] SetLastError (dwErrCode=0x12) [0080.186] GetLastError () returned 0x12 [0080.186] SetLastError (dwErrCode=0x12) [0080.194] CloseHandle (hObject=0x33c) returned 1 [0080.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.211] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.227] SetLastError (dwErrCode=0x12) [0080.227] GetLastError () returned 0x12 [0080.227] SetLastError (dwErrCode=0x12) [0080.246] SetLastError (dwErrCode=0x12) [0080.246] GetLastError () returned 0x12 [0080.247] SetLastError (dwErrCode=0x12) [0080.255] SetLastError (dwErrCode=0x12) [0080.255] GetLastError () returned 0x12 [0080.255] SetLastError (dwErrCode=0x12) [0080.258] SetLastError (dwErrCode=0x12) [0080.258] GetLastError () returned 0x12 [0080.258] SetLastError (dwErrCode=0x12) [0080.282] SetLastError (dwErrCode=0x12) [0080.282] GetLastError () returned 0x12 [0080.282] SetLastError (dwErrCode=0x12) [0080.283] SetLastError (dwErrCode=0x12) [0080.283] GetLastError () returned 0x12 [0080.283] SetLastError (dwErrCode=0x12) [0080.284] SetLastError (dwErrCode=0x12) [0080.284] GetLastError () returned 0x12 [0080.284] SetLastError (dwErrCode=0x12) [0080.289] CloseHandle (hObject=0x33c) returned 1 [0080.289] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.301] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.303] SetLastError (dwErrCode=0x12) [0080.303] GetLastError () returned 0x12 [0080.303] SetLastError (dwErrCode=0x12) [0080.304] SetLastError (dwErrCode=0x12) [0080.304] GetLastError () returned 0x12 [0080.304] SetLastError (dwErrCode=0x12) [0080.305] SetLastError (dwErrCode=0x12) [0080.306] GetLastError () returned 0x12 [0080.306] SetLastError (dwErrCode=0x12) [0080.323] SetLastError (dwErrCode=0x12) [0080.323] GetLastError () returned 0x12 [0080.323] SetLastError (dwErrCode=0x12) [0080.330] SetLastError (dwErrCode=0x12) [0080.330] GetLastError () returned 0x12 [0080.330] SetLastError (dwErrCode=0x12) [0080.331] SetLastError (dwErrCode=0x12) [0080.331] GetLastError () returned 0x12 [0080.331] SetLastError (dwErrCode=0x12) [0080.332] SetLastError (dwErrCode=0x12) [0080.332] GetLastError () returned 0x12 [0080.332] SetLastError (dwErrCode=0x12) [0080.338] SetLastError (dwErrCode=0x12) [0080.338] GetLastError () returned 0x12 [0080.338] SetLastError (dwErrCode=0x12) [0080.344] SetLastError (dwErrCode=0x12) [0080.344] GetLastError () returned 0x12 [0080.344] SetLastError (dwErrCode=0x12) [0080.349] SetLastError (dwErrCode=0x12) [0080.349] GetLastError () returned 0x12 [0080.349] SetLastError (dwErrCode=0x12) [0080.362] SetLastError (dwErrCode=0x12) [0080.362] GetLastError () returned 0x12 [0080.362] SetLastError (dwErrCode=0x12) [0080.382] CloseHandle (hObject=0x33c) returned 1 [0080.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.391] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.407] SetLastError (dwErrCode=0x12) [0080.407] GetLastError () returned 0x12 [0080.407] SetLastError (dwErrCode=0x12) [0080.424] SetLastError (dwErrCode=0x12) [0080.424] GetLastError () returned 0x12 [0080.424] SetLastError (dwErrCode=0x12) [0080.434] SetLastError (dwErrCode=0x12) [0080.434] GetLastError () returned 0x12 [0080.434] SetLastError (dwErrCode=0x12) [0080.437] SetLastError (dwErrCode=0x12) [0080.437] GetLastError () returned 0x12 [0080.437] SetLastError (dwErrCode=0x12) [0080.460] SetLastError (dwErrCode=0x12) [0080.460] GetLastError () returned 0x12 [0080.460] SetLastError (dwErrCode=0x12) [0080.461] SetLastError (dwErrCode=0x12) [0080.461] GetLastError () returned 0x12 [0080.461] SetLastError (dwErrCode=0x12) [0080.461] SetLastError (dwErrCode=0x12) [0080.461] GetLastError () returned 0x12 [0080.461] SetLastError (dwErrCode=0x12) [0080.467] CloseHandle (hObject=0x33c) returned 1 [0080.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.475] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.476] SetLastError (dwErrCode=0x12) [0080.476] GetLastError () returned 0x12 [0080.476] SetLastError (dwErrCode=0x12) [0080.513] SetLastError (dwErrCode=0x12) [0080.513] GetLastError () returned 0x12 [0080.513] SetLastError (dwErrCode=0x12) [0080.549] SetLastError (dwErrCode=0x12) [0080.549] GetLastError () returned 0x12 [0080.549] SetLastError (dwErrCode=0x12) [0080.553] SetLastError (dwErrCode=0x12) [0080.553] GetLastError () returned 0x12 [0080.553] SetLastError (dwErrCode=0x12) [0080.559] SetLastError (dwErrCode=0x12) [0080.559] GetLastError () returned 0x12 [0080.559] SetLastError (dwErrCode=0x12) [0080.563] CloseHandle (hObject=0x33c) returned 1 [0080.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.572] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.595] SetLastError (dwErrCode=0x12) [0080.595] GetLastError () returned 0x12 [0080.595] SetLastError (dwErrCode=0x12) [0080.595] SetLastError (dwErrCode=0x12) [0080.595] GetLastError () returned 0x12 [0080.595] SetLastError (dwErrCode=0x12) [0080.610] SetLastError (dwErrCode=0x12) [0080.610] GetLastError () returned 0x12 [0080.610] SetLastError (dwErrCode=0x12) [0080.612] SetLastError (dwErrCode=0x12) [0080.612] GetLastError () returned 0x12 [0080.613] SetLastError (dwErrCode=0x12) [0080.614] SetLastError (dwErrCode=0x12) [0080.614] GetLastError () returned 0x12 [0080.614] SetLastError (dwErrCode=0x12) [0080.614] GetLastError () returned 0x12 [0080.614] SetLastError (dwErrCode=0x12) [0080.614] GetLastError () returned 0x12 [0080.614] SetLastError (dwErrCode=0x12) [0080.618] SetLastError (dwErrCode=0x12) [0080.618] GetLastError () returned 0x12 [0080.618] SetLastError (dwErrCode=0x12) [0080.629] SetLastError (dwErrCode=0x12) [0080.629] GetLastError () returned 0x12 [0080.629] SetLastError (dwErrCode=0x12) [0080.633] SetLastError (dwErrCode=0x12) [0080.633] GetLastError () returned 0x12 [0080.633] SetLastError (dwErrCode=0x12) [0080.644] SetLastError (dwErrCode=0x12) [0080.644] GetLastError () returned 0x12 [0080.644] SetLastError (dwErrCode=0x12) [0080.668] SetLastError (dwErrCode=0x12) [0080.668] GetLastError () returned 0x12 [0080.668] SetLastError (dwErrCode=0x12) [0080.669] SetLastError (dwErrCode=0x12) [0080.669] GetLastError () returned 0x12 [0080.669] SetLastError (dwErrCode=0x12) [0080.670] SetLastError (dwErrCode=0x12) [0080.670] GetLastError () returned 0x12 [0080.670] SetLastError (dwErrCode=0x12) [0080.671] SetLastError (dwErrCode=0x12) [0080.671] GetLastError () returned 0x12 [0080.671] SetLastError (dwErrCode=0x12) [0080.672] SetLastError (dwErrCode=0x12) [0080.672] GetLastError () returned 0x12 [0080.672] SetLastError (dwErrCode=0x12) [0080.693] SetLastError (dwErrCode=0x12) [0080.693] GetLastError () returned 0x12 [0080.693] SetLastError (dwErrCode=0x12) [0080.693] GetLastError () returned 0x12 [0080.693] SetLastError (dwErrCode=0x12) [0080.693] GetLastError () returned 0x12 [0080.693] SetLastError (dwErrCode=0x12) [0080.725] CloseHandle (hObject=0x33c) returned 1 [0080.725] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.733] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.735] SetLastError (dwErrCode=0x12) [0080.735] GetLastError () returned 0x12 [0080.735] SetLastError (dwErrCode=0x12) [0080.736] SetLastError (dwErrCode=0x12) [0080.737] GetLastError () returned 0x12 [0080.737] SetLastError (dwErrCode=0x12) [0080.738] SetLastError (dwErrCode=0x12) [0080.738] GetLastError () returned 0x12 [0080.738] SetLastError (dwErrCode=0x12) [0080.755] SetLastError (dwErrCode=0x12) [0080.755] GetLastError () returned 0x12 [0080.755] SetLastError (dwErrCode=0x12) [0080.770] SetLastError (dwErrCode=0x12) [0080.770] GetLastError () returned 0x12 [0080.770] SetLastError (dwErrCode=0x12) [0080.772] SetLastError (dwErrCode=0x12) [0080.772] GetLastError () returned 0x12 [0080.772] SetLastError (dwErrCode=0x12) [0080.772] SetLastError (dwErrCode=0x12) [0080.772] GetLastError () returned 0x12 [0080.772] SetLastError (dwErrCode=0x12) [0080.779] SetLastError (dwErrCode=0x12) [0080.779] GetLastError () returned 0x12 [0080.779] SetLastError (dwErrCode=0x12) [0080.784] SetLastError (dwErrCode=0x12) [0080.784] GetLastError () returned 0x12 [0080.784] SetLastError (dwErrCode=0x12) [0080.790] SetLastError (dwErrCode=0x12) [0080.790] GetLastError () returned 0x12 [0080.790] SetLastError (dwErrCode=0x12) [0080.801] SetLastError (dwErrCode=0x12) [0080.801] GetLastError () returned 0x12 [0080.801] SetLastError (dwErrCode=0x12) [0080.836] CloseHandle (hObject=0x33c) returned 1 [0080.836] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.845] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.878] SetLastError (dwErrCode=0x12) [0080.878] GetLastError () returned 0x12 [0080.878] SetLastError (dwErrCode=0x12) [0080.913] SetLastError (dwErrCode=0x12) [0080.913] GetLastError () returned 0x12 [0080.914] SetLastError (dwErrCode=0x12) [0080.935] CloseHandle (hObject=0x33c) returned 1 [0080.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0080.943] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.947] SetLastError (dwErrCode=0x12) [0080.947] GetLastError () returned 0x12 [0080.947] SetLastError (dwErrCode=0x12) [0080.954] SetLastError (dwErrCode=0x12) [0080.954] GetLastError () returned 0x12 [0080.954] SetLastError (dwErrCode=0x12) [0080.967] SetLastError (dwErrCode=0x12) [0080.967] GetLastError () returned 0x12 [0080.967] SetLastError (dwErrCode=0x12) [0080.969] SetLastError (dwErrCode=0x12) [0080.969] GetLastError () returned 0x12 [0080.969] SetLastError (dwErrCode=0x12) [0080.971] SetLastError (dwErrCode=0x12) [0080.971] GetLastError () returned 0x12 [0080.971] SetLastError (dwErrCode=0x12) [0080.976] SetLastError (dwErrCode=0x12) [0080.976] GetLastError () returned 0x12 [0080.976] SetLastError (dwErrCode=0x12) [0081.032] SetLastError (dwErrCode=0x12) [0081.032] GetLastError () returned 0x12 [0081.032] SetLastError (dwErrCode=0x12) [0081.036] SetLastError (dwErrCode=0x12) [0081.036] GetLastError () returned 0x12 [0081.036] SetLastError (dwErrCode=0x12) [0081.044] SetLastError (dwErrCode=0x12) [0081.044] GetLastError () returned 0x12 [0081.044] SetLastError (dwErrCode=0x12) [0081.052] SetLastError (dwErrCode=0x12) [0081.052] GetLastError () returned 0x12 [0081.052] SetLastError (dwErrCode=0x12) [0081.054] SetLastError (dwErrCode=0x12) [0081.054] GetLastError () returned 0x12 [0081.054] SetLastError (dwErrCode=0x12) [0081.055] SetLastError (dwErrCode=0x12) [0081.055] GetLastError () returned 0x12 [0081.055] SetLastError (dwErrCode=0x12) [0081.056] SetLastError (dwErrCode=0x12) [0081.056] GetLastError () returned 0x12 [0081.056] SetLastError (dwErrCode=0x12) [0081.057] SetLastError (dwErrCode=0x12) [0081.057] GetLastError () returned 0x12 [0081.057] SetLastError (dwErrCode=0x12) [0081.075] SetLastError (dwErrCode=0x12) [0081.075] GetLastError () returned 0x12 [0081.075] SetLastError (dwErrCode=0x12) [0081.083] CloseHandle (hObject=0x33c) returned 1 [0081.083] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0081.092] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.095] SetLastError (dwErrCode=0x12) [0081.095] GetLastError () returned 0x12 [0081.095] SetLastError (dwErrCode=0x12) [0081.098] SetLastError (dwErrCode=0x12) [0081.098] GetLastError () returned 0x12 [0081.098] SetLastError (dwErrCode=0x12) [0081.099] SetLastError (dwErrCode=0x12) [0081.099] GetLastError () returned 0x12 [0081.099] SetLastError (dwErrCode=0x12) [0081.100] SetLastError (dwErrCode=0x12) [0081.100] GetLastError () returned 0x12 [0081.101] SetLastError (dwErrCode=0x12) [0081.101] SetLastError (dwErrCode=0x12) [0081.101] GetLastError () returned 0x12 [0081.101] SetLastError (dwErrCode=0x12) [0081.102] SetLastError (dwErrCode=0x12) [0081.102] GetLastError () returned 0x12 [0081.102] SetLastError (dwErrCode=0x12) [0081.102] SetLastError (dwErrCode=0x12) [0081.102] GetLastError () returned 0x12 [0081.103] SetLastError (dwErrCode=0x12) [0081.103] SetLastError (dwErrCode=0x12) [0081.103] GetLastError () returned 0x12 [0081.103] SetLastError (dwErrCode=0x12) [0081.104] SetLastError (dwErrCode=0x12) [0081.104] GetLastError () returned 0x12 [0081.104] SetLastError (dwErrCode=0x12) [0081.105] SetLastError (dwErrCode=0x12) [0081.105] GetLastError () returned 0x12 [0081.105] SetLastError (dwErrCode=0x12) [0081.105] SetLastError (dwErrCode=0x12) [0081.105] GetLastError () returned 0x12 [0081.105] SetLastError (dwErrCode=0x12) [0081.106] SetLastError (dwErrCode=0x12) [0081.106] GetLastError () returned 0x12 [0081.106] SetLastError (dwErrCode=0x12) [0081.107] SetLastError (dwErrCode=0x12) [0081.107] GetLastError () returned 0x12 [0081.107] SetLastError (dwErrCode=0x12) [0081.107] SetLastError (dwErrCode=0x12) [0081.107] GetLastError () returned 0x12 [0081.107] SetLastError (dwErrCode=0x12) [0081.108] SetLastError (dwErrCode=0x12) [0081.108] GetLastError () returned 0x12 [0081.108] SetLastError (dwErrCode=0x12) [0081.109] SetLastError (dwErrCode=0x12) [0081.109] GetLastError () returned 0x12 [0081.109] SetLastError (dwErrCode=0x12) [0081.110] SetLastError (dwErrCode=0x12) [0081.110] GetLastError () returned 0x12 [0081.110] SetLastError (dwErrCode=0x12) [0081.115] SetLastError (dwErrCode=0x12) [0081.115] GetLastError () returned 0x12 [0081.115] SetLastError (dwErrCode=0x12) [0081.122] SetLastError (dwErrCode=0x12) [0081.122] GetLastError () returned 0x12 [0081.122] SetLastError (dwErrCode=0x12) [0081.123] SetLastError (dwErrCode=0x12) [0081.123] GetLastError () returned 0x12 [0081.123] SetLastError (dwErrCode=0x12) [0081.128] SetLastError (dwErrCode=0x12) [0081.128] GetLastError () returned 0x12 [0081.128] SetLastError (dwErrCode=0x12) [0081.157] SetLastError (dwErrCode=0x12) [0081.157] GetLastError () returned 0x12 [0081.157] SetLastError (dwErrCode=0x12) [0081.159] SetLastError (dwErrCode=0x12) [0081.159] GetLastError () returned 0x12 [0081.159] SetLastError (dwErrCode=0x12) [0081.171] SetLastError (dwErrCode=0x12) [0081.171] GetLastError () returned 0x12 [0081.171] SetLastError (dwErrCode=0x12) [0081.179] SetLastError (dwErrCode=0x12) [0081.179] GetLastError () returned 0x12 [0081.179] SetLastError (dwErrCode=0x12) [0081.185] SetLastError (dwErrCode=0x12) [0081.185] GetLastError () returned 0x12 [0081.185] SetLastError (dwErrCode=0x12) [0081.190] SetLastError (dwErrCode=0x12) [0081.191] GetLastError () returned 0x12 [0081.191] SetLastError (dwErrCode=0x12) [0081.191] SetLastError (dwErrCode=0x12) [0081.191] GetLastError () returned 0x12 [0081.191] SetLastError (dwErrCode=0x12) [0081.192] SetLastError (dwErrCode=0x12) [0081.192] GetLastError () returned 0x12 [0081.192] SetLastError (dwErrCode=0x12) [0081.194] CloseHandle (hObject=0x33c) returned 1 [0081.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0081.206] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.208] SetLastError (dwErrCode=0x12) [0081.208] GetLastError () returned 0x12 [0081.208] SetLastError (dwErrCode=0x12) [0081.317] SetLastError (dwErrCode=0x12) [0081.317] GetLastError () returned 0x12 [0081.317] SetLastError (dwErrCode=0x12) [0081.322] SetLastError (dwErrCode=0x12) [0081.322] GetLastError () returned 0x12 [0081.322] SetLastError (dwErrCode=0x12) [0081.328] SetLastError (dwErrCode=0x12) [0081.328] GetLastError () returned 0x12 [0081.329] SetLastError (dwErrCode=0x12) [0081.338] CloseHandle (hObject=0x33c) returned 1 [0081.338] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0081.346] Process32FirstW (in: hSnapshot=0x33c, lppe=0x10ff438 | out: lppe=0x10ff438*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.362] SetLastError (dwErrCode=0x12) [0081.362] GetLastError () returned 0x12 [0081.362] SetLastError (dwErrCode=0x12) [0081.383] SetLastError (dwErrCode=0x12) [0081.383] GetLastError () returned 0x12 [0081.383] SetLastError (dwErrCode=0x12) [0081.393] SetLastError (dwErrCode=0x12) [0081.393] GetLastError () returned 0x12 [0081.393] SetLastError (dwErrCode=0x12) [0081.396] SetLastError (dwErrCode=0x12) [0081.396] GetLastError () returned 0x12 [0081.396] SetLastError (dwErrCode=0x12) [0081.424] SetLastError (dwErrCode=0x12) [0081.424] GetLastError () returned 0x12 [0081.424] SetLastError (dwErrCode=0x12) [0081.425] SetLastError (dwErrCode=0x12) [0081.425] GetLastError () returned 0x12 [0081.425] SetLastError (dwErrCode=0x12) [0081.426] SetLastError (dwErrCode=0x12) [0081.426] GetLastError () returned 0x12 [0081.426] SetLastError (dwErrCode=0x12) [0081.432] CloseHandle (hObject=0x33c) returned 1 [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.433] SetLastError (dwErrCode=0x12) [0081.433] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.434] SetLastError (dwErrCode=0x12) [0081.434] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.435] SetLastError (dwErrCode=0x12) [0081.435] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.436] SetLastError (dwErrCode=0x12) [0081.436] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.437] GetLastError () returned 0x12 [0081.437] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.438] GetLastError () returned 0x12 [0081.438] SetLastError (dwErrCode=0x12) [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.439] SetLastError (dwErrCode=0x12) [0081.439] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.440] SetLastError (dwErrCode=0x12) [0081.440] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.441] SetLastError (dwErrCode=0x12) [0081.441] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.442] GetLastError () returned 0x12 [0081.442] SetLastError (dwErrCode=0x12) [0081.443] GetLastError () returned 0x12 [0081.443] SetLastError (dwErrCode=0x12) [0081.443] GetLastError () returned 0x12 [0081.443] SetLastError (dwErrCode=0x12) [0081.443] GetLastError () returned 0x12 [0081.443] SetLastError (dwErrCode=0x12) [0081.443] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0xf003f, phkResult=0x10ff678 | out: phkResult=0x10ff678*=0x33c) returned 0x0 [0081.446] RegSetValueExW (in: hKey=0x33c, lpValueName="EnableLinkedConnections", Reserved=0x0, dwType=0x4, lpData=0x10ff674*=0x1, cbData=0x4 | out: lpData=0x10ff674*=0x1) returned 0x0 [0081.451] RegCloseKey (hKey=0x33c) returned 0x0 [0081.451] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364f78 | out: hHeap=0x310000) returned 1 [0081.451] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0081.451] GetLogicalDrives () returned 0x4 [0081.452] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361aa8 [0081.452] WNetGetConnectionW (in: lpLocalName="A:", lpRemoteName=0x361aa8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.454] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x35f6a0 [0081.454] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361cd0 [0081.454] WNetGetConnectionW (in: lpLocalName="B:", lpRemoteName=0x361cd0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0081.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35f6a0 | out: hHeap=0x310000) returned 1 [0081.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361ef8 [0081.456] WNetGetConnectionW (in: lpLocalName="C:", lpRemoteName=0x361ef8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361ef8 | out: hHeap=0x310000) returned 1 [0081.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362798 [0081.456] WNetGetConnectionW (in: lpLocalName="D:", lpRemoteName=0x362798, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.458] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x366128 [0081.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0081.458] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363038 [0081.458] WNetGetConnectionW (in: lpLocalName="E:", lpRemoteName=0x363038, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x35efc0 [0081.460] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x366128 | out: hHeap=0x310000) returned 1 [0081.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x361ef8 [0081.460] WNetGetConnectionW (in: lpLocalName="F:", lpRemoteName=0x361ef8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x35eb80 [0081.462] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35efc0 | out: hHeap=0x310000) returned 1 [0081.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362be8 [0081.462] WNetGetConnectionW (in: lpLocalName="G:", lpRemoteName=0x362be8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362348 [0081.480] WNetGetConnectionW (in: lpLocalName="H:", lpRemoteName=0x362348, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd8) returned 0x3618f0 [0081.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0081.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362e10 [0081.482] WNetGetConnectionW (in: lpLocalName="I:", lpRemoteName=0x362e10, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.483] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363260 [0081.483] WNetGetConnectionW (in: lpLocalName="J:", lpRemoteName=0x363260, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.485] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x363488 [0081.485] WNetGetConnectionW (in: lpLocalName="K:", lpRemoteName=0x363488, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x138) returned 0x366468 [0081.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3618f0 | out: hHeap=0x310000) returned 1 [0081.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3636b0 [0081.487] WNetGetConnectionW (in: lpLocalName="L:", lpRemoteName=0x3636b0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362120 [0081.489] WNetGetConnectionW (in: lpLocalName="M:", lpRemoteName=0x362120, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x3629c0 [0081.490] WNetGetConnectionW (in: lpLocalName="N:", lpRemoteName=0x3629c0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x362570 [0081.492] WNetGetConnectionW (in: lpLocalName="O:", lpRemoteName=0x362570, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x1c8) returned 0x36b330 [0081.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x366468 | out: hHeap=0x310000) returned 1 [0081.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36c810 [0081.494] WNetGetConnectionW (in: lpLocalName="P:", lpRemoteName=0x36c810, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.496] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36dfc8 [0081.496] WNetGetConnectionW (in: lpLocalName="Q:", lpRemoteName=0x36dfc8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36ea90 [0081.498] WNetGetConnectionW (in: lpLocalName="R:", lpRemoteName=0x36ea90, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36ca38 [0081.500] WNetGetConnectionW (in: lpLocalName="S:", lpRemoteName=0x36ca38, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36fdf8 [0081.501] WNetGetConnectionW (in: lpLocalName="T:", lpRemoteName=0x36fdf8, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36cc60 [0081.503] WNetGetConnectionW (in: lpLocalName="U:", lpRemoteName=0x36cc60, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.505] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2a0) returned 0x3703a0 [0081.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36b330 | out: hHeap=0x310000) returned 1 [0081.505] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36e868 [0081.505] WNetGetConnectionW (in: lpLocalName="V:", lpRemoteName=0x36e868, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f330 [0081.506] WNetGetConnectionW (in: lpLocalName="W:", lpRemoteName=0x36f330, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36eee0 [0081.508] WNetGetConnectionW (in: lpLocalName="X:", lpRemoteName=0x36eee0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.510] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36c3c0 [0081.510] WNetGetConnectionW (in: lpLocalName="Y:", lpRemoteName=0x36c3c0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36dda0 [0081.511] WNetGetConnectionW (in: lpLocalName="Z:", lpRemoteName=0x36dda0, lpnLength=0x10ff58c | out: lpRemoteName="", lpnLength=0x10ff58c) returned 0x8ca [0081.513] FindFirstVolumeW (in: lpszVolumeName=0x10ff408, cchBufferLength=0x104 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 0x366468 [0081.513] QueryDosDeviceW (in: lpDeviceName="Volume{df759572-0000-0000-0000-100000000000}", lpTargetPath=0x10ff200, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0081.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0081.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x366610 [0081.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x370020 [0081.514] GetVolumePathNamesForVolumeNameW (in: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\", lpszVolumePathNames=0x370020, cchBufferLength=0x104, lpcchReturnLength=0x10ff190 | out: lpszVolumePathNames=0x370020, lpcchReturnLength=0x10ff190) returned 1 [0081.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x48) returned 0x366218 [0081.514] FindNextVolumeW (in: hFindVolume=0x366468, lpszVolumeName=0x10ff408, cchBufferLength=0x104 | out: hFindVolume=0x366468, lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-10c37f000000}\\") returned 1 [0081.514] QueryDosDeviceW (in: lpDeviceName="Volume{df759572-0000-0000-0000-10c37f000000}", lpTargetPath=0x10ff200, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume2") returned 0x19 [0081.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368520 [0081.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x35efc0 [0081.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f108 [0081.514] GetVolumePathNamesForVolumeNameW (in: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-10c37f000000}\\", lpszVolumePathNames=0x36f108, cchBufferLength=0x104, lpcchReturnLength=0x10ff190 | out: lpszVolumePathNames=0x36f108, lpcchReturnLength=0x10ff190) returned 1 [0081.515] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x35eb80 [0081.515] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x366218 | out: hHeap=0x310000) returned 1 [0081.515] FindNextVolumeW (in: hFindVolume=0x366468, lpszVolumeName=0x10ff408, cchBufferLength=0x104 | out: hFindVolume=0x366468, lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-10c37f000000}\\") returned 0 [0081.515] FindVolumeClose (hFindVolume=0x366468) returned 1 [0081.515] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36dda0 | out: hHeap=0x310000) returned 1 [0081.515] SetVolumeMountPointW (lpszVolumeMountPoint="Z:\\", lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-10c37f000000}\\") returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x370020 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x366610 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f108 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35efc0 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368520 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35eb80 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361aa8 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362798 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363038 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x361ef8 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362be8 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362348 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362e10 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363260 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x363488 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3636b0 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362120 | out: hHeap=0x310000) returned 1 [0081.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3629c0 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x362570 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36c810 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36dfc8 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ea90 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ca38 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36fdf8 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36cc60 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36e868 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f330 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36eee0 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36c3c0 | out: hHeap=0x310000) returned 1 [0081.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3703a0 | out: hHeap=0x310000) returned 1 [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.520] SetLastError (dwErrCode=0x0) [0081.520] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.521] GetLastError () returned 0x0 [0081.521] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ac70 [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.522] GetLastError () returned 0x0 [0081.522] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368328 [0081.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ac70 | out: hHeap=0x310000) returned 1 [0081.523] GetLastError () returned 0x0 [0081.523] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0081.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=34, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0081.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x359310 [0081.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=34, lpWideCharStr=0x359310, cchWideChar=34 | out: lpWideCharStr="wmic.exe SHADOWCOPY /nointeractive") returned 34 [0081.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368328 | out: hHeap=0x310000) returned 1 [0081.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.524] SetLastError (dwErrCode=0x0) [0081.524] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.525] SetLastError (dwErrCode=0x0) [0081.525] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.526] SetLastError (dwErrCode=0x0) [0081.526] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.527] SetLastError (dwErrCode=0x0) [0081.527] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0081.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0081.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0081.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x367fe0, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0081.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3591b0 [0081.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x367fe0, cbMultiByte=32, lpWideCharStr=0x3591b0, cchWideChar=32 | out: lpWideCharStr="wbadmin DELETE SYSTEMSTATEBACKUP") returned 32 [0081.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368590 | out: hHeap=0x310000) returned 1 [0081.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.528] SetLastError (dwErrCode=0x0) [0081.528] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.529] SetLastError (dwErrCode=0x0) [0081.529] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] SetLastError (dwErrCode=0x0) [0081.530] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] GetLastError () returned 0x0 [0081.531] SetLastError (dwErrCode=0x0) [0081.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0081.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.531] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.532] GetLastError () returned 0x0 [0081.532] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ad60 [0081.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0081.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ad60 | out: hHeap=0x310000) returned 1 [0081.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0081.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x370708 [0081.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=46, lpWideCharStr=0x370708, cchWideChar=46 | out: lpWideCharStr="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest") returned 46 [0081.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0081.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.533] SetLastError (dwErrCode=0x0) [0081.533] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.534] GetLastError () returned 0x0 [0081.534] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.535] GetLastError () returned 0x0 [0081.535] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.536] GetLastError () returned 0x0 [0081.536] SetLastError (dwErrCode=0x0) [0081.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3684b0 [0081.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.537] GetLastError () returned 0x0 [0081.537] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36ae78 [0081.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368590 [0081.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ae78 | out: hHeap=0x310000) returned 1 [0081.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x368590, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0081.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x370978 [0081.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x368590, cbMultiByte=45, lpWideCharStr=0x370978, cchWideChar=45 | out: lpWideCharStr="bcdedit.exe /set {default} recoveryenabled No") returned 45 [0081.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3684b0 | out: hHeap=0x310000) returned 1 [0081.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368590 | out: hHeap=0x310000) returned 1 [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.538] SetLastError (dwErrCode=0x0) [0081.538] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.539] SetLastError (dwErrCode=0x0) [0081.539] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.540] SetLastError (dwErrCode=0x0) [0081.540] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.541] GetLastError () returned 0x0 [0081.541] SetLastError (dwErrCode=0x0) [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x365e58 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x367fe0 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x47) returned 0x365ea8 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x367fe0 | out: hHeap=0x310000) returned 1 [0081.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x365ea8, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3649a0 [0081.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x365ea8, cbMultiByte=61, lpWideCharStr=0x3649a0, cchWideChar=61 | out: lpWideCharStr="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures") returned 61 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365e58 | out: hHeap=0x310000) returned 1 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365ea8 | out: hHeap=0x310000) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aef0 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x368018 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aef0 | out: hHeap=0x310000) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36aba8 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x3682f0 [0081.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36aba8 | out: hHeap=0x310000) returned 1 [0081.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0081.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3598e8 [0081.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x3682f0, cbMultiByte=39, lpWideCharStr=0x3598e8, cchWideChar=39 | out: lpWideCharStr="vssadmin.exe Delete Shadows /All /Quiet") returned 39 [0081.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x368018 | out: hHeap=0x310000) returned 1 [0081.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3682f0 | out: hHeap=0x310000) returned 1 [0081.543] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessInformation=0x10ff570*(hProcess=0x33c, hThread=0x340, dwProcessId=0x10cc, dwThreadId=0x113c)) returned 1 [0081.910] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0094.549] CloseHandle (hObject=0x340) returned 1 [0094.549] CloseHandle (hObject=0x33c) returned 1 [0094.549] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0094.563] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0094.576] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0094.650] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0094.671] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x10ff570*(hProcess=0x340, hThread=0x33c, dwProcessId=0xe50, dwThreadId=0x11f0)) returned 1 [0094.957] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0113.434] CloseHandle (hObject=0x33c) returned 1 [0113.434] CloseHandle (hObject=0x340) returned 1 [0113.434] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessInformation=0x10ff570*(hProcess=0x33c, hThread=0x340, dwProcessId=0xe54, dwThreadId=0x440)) returned 1 [0113.537] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0124.376] CloseHandle (hObject=0x340) returned 1 [0124.376] CloseHandle (hObject=0x33c) returned 1 [0124.376] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0124.388] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0124.402] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0124.427] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0124.457] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x10ff570*(hProcess=0x340, hThread=0x33c, dwProcessId=0x133c, dwThreadId=0x132c)) returned 1 [0124.471] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0127.869] CloseHandle (hObject=0x33c) returned 1 [0127.869] CloseHandle (hObject=0x340) returned 1 [0127.869] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wmic.exe SHADOWCOPY /nointeractive", lpProcessInformation=0x10ff570*(hProcess=0x33c, hThread=0x340, dwProcessId=0x13bc, dwThreadId=0x13cc)) returned 1 [0127.896] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0131.342] CloseHandle (hObject=0x340) returned 1 [0131.342] CloseHandle (hObject=0x33c) returned 1 [0131.342] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0131.352] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0131.365] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} recoveryenabled No", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0131.418] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x10ff570*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0131.438] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x10ff580*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10ff570 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x10ff570*(hProcess=0x340, hThread=0x33c, dwProcessId=0x10ec, dwThreadId=0x10e0)) returned 1 [0131.451] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0xffffffff) returned 0x0 [0132.530] CloseHandle (hObject=0x33c) returned 1 [0132.530] CloseHandle (hObject=0x340) returned 1 [0132.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3598e8 | out: hHeap=0x310000) returned 1 [0132.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3649a0 | out: hHeap=0x310000) returned 1 [0132.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x370978 | out: hHeap=0x310000) returned 1 [0132.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x370708 | out: hHeap=0x310000) returned 1 [0132.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3591b0 | out: hHeap=0x310000) returned 1 [0132.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x359310 | out: hHeap=0x310000) returned 1 [0132.532] SHEmptyRecycleBinW (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c258 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x396cf0 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c7d8 [0133.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x341e58 | out: hHeap=0x310000) returned 1 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3924d0 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392260 [0133.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3924d0 | out: hHeap=0x310000) returned 1 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3924d0 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0133.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0133.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x396a10 [0133.726] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x396a1c | out: phModule=0x396a1c*=0x250000) returned 1 [0133.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x396a10, dwCreationFlags=0x0, lpThreadId=0x10ff560 | out: lpThreadId=0x10ff560*=0xa6c) returned 0x460 [0133.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0133.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0133.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392260 | out: hHeap=0x310000) returned 1 [0133.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0133.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0133.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad88 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39aef0 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39af68 [0133.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39aef0 | out: hHeap=0x310000) returned 1 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c1b0 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae00 [0133.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x396b30 [0133.727] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x396b3c | out: phModule=0x396b3c*=0x250000) returned 1 [0133.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x396b30, dwCreationFlags=0x0, lpThreadId=0x10ff560 | out: lpThreadId=0x10ff560*=0x10dc) returned 0x46c [0133.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39af68 | out: hHeap=0x310000) returned 1 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398068 [0133.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0133.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0133.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399560 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399668 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3996c0 [0133.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399668 | out: hHeap=0x310000) returned 1 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399668 [0133.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x3969b0 [0133.729] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x3969bc | out: phModule=0x3969bc*=0x250000) returned 1 [0133.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x3969b0, dwCreationFlags=0x0, lpThreadId=0x10ff560 | out: lpThreadId=0x10ff560*=0xe70) returned 0x470 [0133.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3996c0 | out: hHeap=0x310000) returned 1 [0133.729] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392260 [0133.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398068 | out: hHeap=0x310000) returned 1 [0133.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b10 [0133.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391630 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0133.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bd88 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391e50 [0133.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x396910 [0133.730] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x39691c | out: phModule=0x39691c*=0x250000) returned 1 [0133.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x396910, dwCreationFlags=0x0, lpThreadId=0x10ff560 | out: lpThreadId=0x10ff560*=0x388) returned 0x474 [0133.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0133.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0133.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392260 | out: hHeap=0x310000) returned 1 [0133.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0133.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bbc8 [0133.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x396a90 [0133.732] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x396a9c | out: phModule=0x396a9c*=0x250000) returned 1 [0133.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x396a90, dwCreationFlags=0x0, lpThreadId=0x10ff560 | out: lpThreadId=0x10ff560*=0x5a8) returned 0x478 [0133.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x3803b8 [0133.733] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0133.733] GetLogicalDrives () returned 0x2000004 [0133.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f780 [0133.733] WNetGetConnectionW (in: lpLocalName="A:", lpRemoteName=0x36f780, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f780 | out: hHeap=0x310000) returned 1 [0133.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36e1f0 [0133.735] WNetGetConnectionW (in: lpLocalName="B:", lpRemoteName=0x36e1f0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.736] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36e1f0 | out: hHeap=0x310000) returned 1 [0133.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36c5e8 [0133.736] WNetGetConnectionW (in: lpLocalName="C:", lpRemoteName=0x36c5e8, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x396930 [0133.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f558 [0133.736] WNetGetConnectionW (in: lpLocalName="D:", lpRemoteName=0x36f558, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f558 | out: hHeap=0x310000) returned 1 [0133.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36d0b0 [0133.738] WNetGetConnectionW (in: lpLocalName="E:", lpRemoteName=0x36d0b0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36d0b0 | out: hHeap=0x310000) returned 1 [0133.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36d728 [0133.739] WNetGetConnectionW (in: lpLocalName="F:", lpRemoteName=0x36d728, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36d728 | out: hHeap=0x310000) returned 1 [0133.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36c810 [0133.741] WNetGetConnectionW (in: lpLocalName="G:", lpRemoteName=0x36c810, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36c810 | out: hHeap=0x310000) returned 1 [0133.742] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f558 [0133.742] WNetGetConnectionW (in: lpLocalName="H:", lpRemoteName=0x36f558, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f558 | out: hHeap=0x310000) returned 1 [0133.744] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36fbd0 [0133.744] WNetGetConnectionW (in: lpLocalName="I:", lpRemoteName=0x36fbd0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36fbd0 | out: hHeap=0x310000) returned 1 [0133.745] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f9a8 [0133.745] WNetGetConnectionW (in: lpLocalName="J:", lpRemoteName=0x36f9a8, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f9a8 | out: hHeap=0x310000) returned 1 [0133.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36cc60 [0133.747] WNetGetConnectionW (in: lpLocalName="K:", lpRemoteName=0x36cc60, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.822] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36cc60 | out: hHeap=0x310000) returned 1 [0133.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f108 [0133.822] WNetGetConnectionW (in: lpLocalName="L:", lpRemoteName=0x36f108, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.823] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f108 | out: hHeap=0x310000) returned 1 [0133.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f780 [0133.823] WNetGetConnectionW (in: lpLocalName="M:", lpRemoteName=0x36f780, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.825] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f780 | out: hHeap=0x310000) returned 1 [0133.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36db78 [0133.825] WNetGetConnectionW (in: lpLocalName="N:", lpRemoteName=0x36db78, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.826] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36db78 | out: hHeap=0x310000) returned 1 [0133.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36e640 [0133.826] WNetGetConnectionW (in: lpLocalName="O:", lpRemoteName=0x36e640, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36e640 | out: hHeap=0x310000) returned 1 [0133.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36cc60 [0133.828] WNetGetConnectionW (in: lpLocalName="P:", lpRemoteName=0x36cc60, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.829] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36cc60 | out: hHeap=0x310000) returned 1 [0133.829] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36fbd0 [0133.829] WNetGetConnectionW (in: lpLocalName="Q:", lpRemoteName=0x36fbd0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36fbd0 | out: hHeap=0x310000) returned 1 [0133.830] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36db78 [0133.830] WNetGetConnectionW (in: lpLocalName="R:", lpRemoteName=0x36db78, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36db78 | out: hHeap=0x310000) returned 1 [0133.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36eee0 [0133.832] WNetGetConnectionW (in: lpLocalName="S:", lpRemoteName=0x36eee0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36eee0 | out: hHeap=0x310000) returned 1 [0133.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36d0b0 [0133.833] WNetGetConnectionW (in: lpLocalName="T:", lpRemoteName=0x36d0b0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36d0b0 | out: hHeap=0x310000) returned 1 [0133.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36d0b0 [0133.835] WNetGetConnectionW (in: lpLocalName="U:", lpRemoteName=0x36d0b0, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36d0b0 | out: hHeap=0x310000) returned 1 [0133.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36ecb8 [0133.836] WNetGetConnectionW (in: lpLocalName="V:", lpRemoteName=0x36ecb8, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ecb8 | out: hHeap=0x310000) returned 1 [0133.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36ecb8 [0133.837] WNetGetConnectionW (in: lpLocalName="W:", lpRemoteName=0x36ecb8, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36ecb8 | out: hHeap=0x310000) returned 1 [0133.839] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36cc60 [0133.839] WNetGetConnectionW (in: lpLocalName="X:", lpRemoteName=0x36cc60, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.840] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36cc60 | out: hHeap=0x310000) returned 1 [0133.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36f108 [0133.840] WNetGetConnectionW (in: lpLocalName="Y:", lpRemoteName=0x36f108, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.842] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36f108 | out: hHeap=0x310000) returned 1 [0133.842] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x210) returned 0x36fdf8 [0133.842] WNetGetConnectionW (in: lpLocalName="Z:", lpRemoteName=0x36fdf8, lpnLength=0x10ff5cc | out: lpRemoteName="", lpnLength=0x10ff5cc) returned 0x8ca [0133.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c1b0 [0133.843] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x396930 | out: hHeap=0x310000) returned 1 [0133.843] GetLastError () returned 0x8ca [0133.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bd50 [0133.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x396a50 [0133.843] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x265610, phModule=0x396a5c | out: phModule=0x396a5c*=0x250000) returned 1 [0133.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x396a50, dwCreationFlags=0x0, lpThreadId=0x10ff5c8 | out: lpThreadId=0x10ff5c8*=0x710) returned 0x48c [0133.844] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10ff334 | out: lpWSAData=0x10ff334) returned 0 [0133.849] gethostname (in: name=0x10ff4e8, namelen=260 | out: name="NQdPdE") returned 0 [0139.042] gethostbyname (name="NQdPdE") returned 0x3985f0*(h_name="NQdPdE", h_aliases=0x398600*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x398604*=([0]="192.168.0.241")) [0141.708] inet_ntoa (in=0xf100a8c0) returned="192.168.0.241" [0141.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff310, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0141.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c228 [0141.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x8, lpMultiByteStr=0x10ff310, cbMultiByte=13, lpWideCharStr=0x38c228, cchWideChar=13 | out: lpWideCharStr="192.168.0.241") returned 13 [0141.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x10ff260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0141.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x10ff260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0141.708] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0141.708] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0141.745] SendARP (in: DestIP=0xf100a8c0, SrcIP=0xf100a8c0, pMacAddr=0x10ff2dc, PhyAddrLen=0x10ff2c0 | out: pMacAddr=0x10ff2dc, PhyAddrLen=0x10ff2c0) returned 0x0 [0141.746] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x18) returned 0x5ad1f68 [0141.746] WSACleanup () returned 0 [0143.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0143.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x3e3f40 [0143.293] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x258590, phModule=0x3e3f4c | out: phModule=0x3e3f4c*=0x250000) returned 1 [0143.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2a0b6b, lpParameter=0x3e3f40, dwCreationFlags=0x0, lpThreadId=0x10ff5dc | out: lpThreadId=0x10ff5dc*=0xd94) returned 0x684 [0143.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x8) returned 0x350ff8 [0143.293] GetCurrentThreadId () returned 0x13d4 [0143.294] WaitForSingleObjectEx (hHandle=0x684, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 2 os_tid = 0x13e0 Thread: id = 3 os_tid = 0x13f4 [0068.580] GetLastError () returned 0x57 [0068.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x343988 [0068.580] SetLastError (dwErrCode=0x57) [0068.580] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x773a0000 [0068.581] GetProcAddress (hModule=0x773a0000, lpProcName="AppPolicyGetThreadInitializationType") returned 0x773a3210 [0068.581] AppPolicyGetThreadInitializationType () returned 0x0 [0068.581] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0070.882] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0097.963] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0098.982] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0102.166] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0103.173] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0104.164] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0108.723] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0111.933] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0116.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0117.156] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0128.725] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0131.972] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0133.003] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 0 [0134.196] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0135.628] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0135.628] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.629] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0135.650] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.650] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0135.650] CloseHandle (hObject=0x5c8) returned 1 [0135.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0135.651] RmStartSession () returned 0x0 [0137.672] RmRegisterResources () returned 0x0 [0137.683] RmGetList () returned 0x0 [0139.848] RmShutdown () returned 0x0 [0141.891] RmEndSession () returned 0x0 [0141.892] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261488) returned 1 [0141.892] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0141.892] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.892] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0141.893] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0141.893] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=3419) returned 1 [0141.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0141.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x659c020 [0142.114] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0142.114] ReadFile (in: hFile=0x618, lpBuffer=0x659c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x659c040*, lpNumberOfBytesRead=0x2c6f6e8*=0xd5b, lpOverlapped=0x0) returned 1 [0142.116] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0142.116] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0142.116] WriteFile (in: hFile=0x618, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0142.116] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0142.116] WriteFile (in: hFile=0x618, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0142.116] WriteFile (in: hFile=0x618, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0142.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x659c020 | out: hHeap=0x310000) returned 1 [0143.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0143.299] CloseHandle (hObject=0x618) returned 1 [0143.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0143.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0143.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2108 [0143.300] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0143.300] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1031\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e54c8 [0143.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0143.305] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eab60 [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.305] SetLastError (dwErrCode=0x0) [0143.305] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b730 [0143.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] GetLastError () returned 0x0 [0143.306] SetLastError (dwErrCode=0x0) [0143.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x51e69c0 [0143.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0143.307] GetLastError () returned 0x0 [0143.307] SetLastError (dwErrCode=0x0) [0143.307] GetLastError () returned 0x0 [0143.307] SetLastError (dwErrCode=0x0) [0143.307] GetLastError () returned 0x0 [0143.307] SetLastError (dwErrCode=0x0) [0143.307] GetLastError () returned 0x0 [0143.307] SetLastError (dwErrCode=0x0) [0143.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eab60 | out: hHeap=0x310000) returned 1 [0143.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0143.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x38c4a8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", lpUsedDefaultChar=0x0) returned 28 [0143.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e69c0 | out: hHeap=0x310000) returned 1 [0143.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0143.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0143.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0143.309] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0143.309] WriteFile (in: hFile=0x618, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6f, lpOverlapped=0x0) returned 1 [0143.310] CloseHandle (hObject=0x618) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e54c8 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2108 | out: hHeap=0x310000) returned 1 [0143.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0143.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.311] CryptDestroyKey (hKey=0x5261488) returned 1 [0143.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0143.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3993a8 | out: hHeap=0x310000) returned 1 [0143.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3656d8 | out: hHeap=0x310000) returned 1 [0143.311] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0143.311] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0143.311] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.311] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0143.325] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.326] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0143.326] CloseHandle (hObject=0x618) returned 1 [0143.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a27f0 [0143.326] RmStartSession () returned 0x0 [0143.329] RmRegisterResources () returned 0x0 [0143.333] RmGetList () returned 0x0 [0143.711] RmShutdown () returned 0x0 [0145.022] RmEndSession () returned 0x0 [0145.023] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261748) returned 1 [0145.023] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0145.024] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0145.024] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.024] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0145.024] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=65238) returned 1 [0145.024] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ad9f8 [0145.024] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a2e020 [0145.046] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0145.046] ReadFile (in: hFile=0x618, lpBuffer=0x6a2e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6a2e040*, lpNumberOfBytesRead=0x2c6f6e8*=0xfed6, lpOverlapped=0x0) returned 1 [0145.071] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.071] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.071] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.071] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.071] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.071] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.072] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.072] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.072] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.072] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.072] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0145.072] WriteFile (in: hFile=0x618, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0145.072] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0145.072] WriteFile (in: hFile=0x618, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0145.072] WriteFile (in: hFile=0x618, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0145.072] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a2e020 | out: hHeap=0x310000) returned 1 [0145.077] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ad9f8 | out: hHeap=0x310000) returned 1 [0145.077] CloseHandle (hObject=0x618) returned 1 [0145.079] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0145.079] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0145.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0145.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaad8 [0145.080] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0145.080] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1042\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0145.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1e98 [0145.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397720 [0145.080] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0145.080] GetLastError () returned 0x0 [0145.080] SetLastError (dwErrCode=0x0) [0145.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0145.081] GetLastError () returned 0x0 [0145.081] SetLastError (dwErrCode=0x0) [0145.081] GetLastError () returned 0x0 [0145.081] SetLastError (dwErrCode=0x0) [0145.081] GetLastError () returned 0x0 [0145.081] SetLastError (dwErrCode=0x0) [0145.081] GetLastError () returned 0x0 [0145.081] SetLastError (dwErrCode=0x0) [0145.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0145.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0145.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x2c6f520, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NQM", lpUsedDefaultChar=0x0) returned 3 [0145.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0145.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x4c07c68 [0145.081] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0145.581] WriteFile (in: hFile=0x584, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x2c6f65c*=0xe56, lpOverlapped=0x0) returned 1 [0145.582] CloseHandle (hObject=0x584) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07c68 | out: hHeap=0x310000) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397720 | out: hHeap=0x310000) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0145.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0145.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0145.583] CryptDestroyKey (hKey=0x5261748) returned 1 [0146.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a27f0 | out: hHeap=0x310000) returned 1 [0146.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0146.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c191a0 | out: hHeap=0x310000) returned 1 [0146.132] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0146.132] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0146.132] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.132] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0146.134] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.134] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0146.134] CloseHandle (hObject=0x5b0) returned 1 [0146.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0146.134] RmStartSession () returned 0x0 [0146.667] RmRegisterResources () returned 0x0 [0146.671] RmGetList () returned 0x0 [0146.811] RmShutdown () returned 0x0 [0147.349] RmEndSession () returned 0x0 [0147.349] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260fc8) returned 1 [0147.349] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0147.350] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x80) returned 1 [0147.350] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0147.350] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0147.350] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=3859) returned 1 [0147.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5ef4008 [0147.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6733020 [0147.368] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0147.482] ReadFile (in: hFile=0x484, lpBuffer=0x6733040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6733040*, lpNumberOfBytesRead=0x2c6f6e8*=0xf13, lpOverlapped=0x0) returned 1 [0147.483] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0147.484] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0147.484] WriteFile (in: hFile=0x484, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0147.484] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0147.484] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0147.484] WriteFile (in: hFile=0x484, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0147.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6733020 | out: hHeap=0x310000) returned 1 [0147.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ef4008 | out: hHeap=0x310000) returned 1 [0147.578] CloseHandle (hObject=0x484) returned 1 [0147.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0147.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0147.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398ed8 [0147.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a23e0 [0147.579] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0147.579] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1055\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0147.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399400 [0147.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0147.593] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0147.593] GetLastError () returned 0x0 [0147.593] SetLastError (dwErrCode=0x0) [0147.593] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0147.593] GetLastError () returned 0x0 [0147.593] SetLastError (dwErrCode=0x0) [0147.593] GetLastError () returned 0x0 [0147.593] SetLastError (dwErrCode=0x0) [0147.593] GetLastError () returned 0x0 [0147.593] SetLastError (dwErrCode=0x0) [0147.593] GetLastError () returned 0x0 [0147.593] SetLastError (dwErrCode=0x0) [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0147.594] GetLastError () returned 0x0 [0147.594] SetLastError (dwErrCode=0x0) [0147.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0147.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x2c6f520, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aA4HcB1IE", lpUsedDefaultChar=0x0) returned 9 [0147.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0147.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0147.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0147.594] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0147.595] WriteFile (in: hFile=0x484, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5c, lpOverlapped=0x0) returned 1 [0147.596] CloseHandle (hObject=0x484) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399400 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0147.596] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3995b8 | out: hHeap=0x310000) returned 1 [0147.596] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19880 | out: hHeap=0x310000) returned 1 [0147.596] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0147.596] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0147.596] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.596] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0147.619] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.619] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0147.619] CloseHandle (hObject=0x484) returned 1 [0147.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0147.619] RmStartSession () returned 0x0 [0147.621] RmRegisterResources () returned 0x0 [0147.625] RmGetList () returned 0x0 [0148.154] RmShutdown () returned 0x0 [0153.560] RmEndSession () returned 0x0 [0153.915] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e88) returned 1 [0153.915] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0153.915] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0153.915] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0153.915] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0153.915] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=60684) returned 1 [0153.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0153.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c4020 [0153.936] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0153.936] ReadFile (in: hFile=0x5c8, lpBuffer=0x58c4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x58c4040*, lpNumberOfBytesRead=0x2c6f6e8*=0xed0c, lpOverlapped=0x0) returned 1 [0153.997] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.997] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.997] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.997] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.997] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.997] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.997] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.998] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.998] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.998] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.998] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0153.998] WriteFile (in: hFile=0x5c8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0153.998] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x5c8, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0153.998] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c4020 | out: hHeap=0x310000) returned 1 [0154.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0154.003] CloseHandle (hObject=0x5c8) returned 1 [0154.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0154.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0154.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1bc0 [0154.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0154.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0154.006] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\2052\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0154.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0154.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0154.006] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0154.006] GetLastError () returned 0x0 [0154.007] SetLastError (dwErrCode=0x0) [0154.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0154.007] GetLastError () returned 0x0 [0154.007] SetLastError (dwErrCode=0x0) [0154.007] GetLastError () returned 0x0 [0154.007] SetLastError (dwErrCode=0x0) [0154.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0154.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0154.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x2c6f520, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0154.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0154.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f05b8 [0154.007] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0154.008] WriteFile (in: hFile=0x5c8, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x2c6f65c*=0xe54, lpOverlapped=0x0) returned 1 [0154.009] CloseHandle (hObject=0x5c8) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f05b8 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1bc0 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0154.009] CryptDestroyKey (hKey=0x5260e88) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50604f8 | out: hHeap=0x310000) returned 1 [0154.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19830 | out: hHeap=0x310000) returned 1 [0154.009] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0154.009] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0154.009] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.010] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0154.315] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.315] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0154.315] CloseHandle (hObject=0x5c8) returned 1 [0154.315] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0154.315] RmStartSession () returned 0x0 [0155.055] RmRegisterResources () returned 0x0 [0155.060] RmGetList () returned 0x0 [0155.979] RmShutdown () returned 0x0 [0156.977] RmEndSession () returned 0x0 [0157.557] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261588) returned 1 [0157.557] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0157.558] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico", dwFileAttributes=0x80) returned 1 [0157.558] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0157.558] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0157.558] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=10134) returned 1 [0157.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8568 [0157.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b4020 [0157.577] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0157.577] ReadFile (in: hFile=0x690, lpBuffer=0x64b4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x64b4040*, lpNumberOfBytesRead=0x2c6f6e8*=0x2796, lpOverlapped=0x0) returned 1 [0157.597] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0157.598] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0157.598] WriteFile (in: hFile=0x690, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0157.598] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0157.598] WriteFile (in: hFile=0x690, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0157.598] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0157.598] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0157.599] WriteFile (in: hFile=0x690, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0157.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b4020 | out: hHeap=0x310000) returned 1 [0157.604] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8568 | out: hHeap=0x310000) returned 1 [0157.604] CloseHandle (hObject=0x690) returned 1 [0157.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0157.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0157.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0157.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0157.605] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0157.605] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0157.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2240 [0157.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a30 [0157.606] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.606] SetLastError (dwErrCode=0x0) [0157.606] GetLastError () returned 0x0 [0157.607] SetLastError (dwErrCode=0x0) [0157.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0157.607] GetLastError () returned 0x0 [0157.607] SetLastError (dwErrCode=0x0) [0157.607] GetLastError () returned 0x0 [0157.607] SetLastError (dwErrCode=0x0) [0157.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0157.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0157.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x2c6f520, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eOdNRgPs7m", lpUsedDefaultChar=0x0) returned 10 [0157.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0157.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0157.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0db0 [0157.607] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0157.608] WriteFile (in: hFile=0x690, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5d, lpOverlapped=0x0) returned 1 [0157.609] CloseHandle (hObject=0x690) returned 1 [0158.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0db0 | out: hHeap=0x310000) returned 1 [0158.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0158.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a30 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2240 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0158.497] CryptDestroyKey (hKey=0x5261588) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50607d0 | out: hHeap=0x310000) returned 1 [0158.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5e40 | out: hHeap=0x310000) returned 1 [0158.497] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0158.497] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0158.497] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.497] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0158.505] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.506] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0158.506] CloseHandle (hObject=0x690) returned 1 [0158.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0158.506] RmStartSession () returned 0x0 [0159.126] RmRegisterResources () returned 0x0 [0159.140] RmGetList () returned 0x0 [0159.552] RmShutdown () returned 0x0 [0160.653] RmEndSession () returned 0x0 [0160.654] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x52619c8) returned 1 [0160.654] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0160.654] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x80) returned 1 [0160.654] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0160.654] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0160.654] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=14084) returned 1 [0160.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bbc5e8 [0160.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6bfb020 [0160.927] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0160.927] ReadFile (in: hFile=0x690, lpBuffer=0x6bfb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6bfb040*, lpNumberOfBytesRead=0x2c6f6e8*=0x3704, lpOverlapped=0x0) returned 1 [0160.960] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0160.960] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0160.960] WriteFile (in: hFile=0x690, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0160.961] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0160.961] WriteFile (in: hFile=0x690, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0160.961] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0160.961] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0160.961] WriteFile (in: hFile=0x690, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0160.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6bfb020 | out: hHeap=0x310000) returned 1 [0161.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbc5e8 | out: hHeap=0x310000) returned 1 [0161.031] CloseHandle (hObject=0x690) returned 1 [0161.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0161.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f00 [0161.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0161.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0161.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f00 | out: hHeap=0x310000) returned 1 [0161.034] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\Strings.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\strings.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c70 [0161.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0161.035] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.035] SetLastError (dwErrCode=0x0) [0161.035] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6f8 [0161.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.036] SetLastError (dwErrCode=0x0) [0161.036] GetLastError () returned 0x0 [0161.037] SetLastError (dwErrCode=0x0) [0161.037] GetLastError () returned 0x0 [0161.037] SetLastError (dwErrCode=0x0) [0161.037] GetLastError () returned 0x0 [0161.037] SetLastError (dwErrCode=0x0) [0161.037] GetLastError () returned 0x0 [0161.037] SetLastError (dwErrCode=0x0) [0161.037] GetLastError () returned 0x0 [0161.037] SetLastError (dwErrCode=0x0) [0161.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0161.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0161.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0161.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x38c4d0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asZJGyY6zFo1elxK4hBU7cY", lpUsedDefaultChar=0x0) returned 23 [0161.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6f8 | out: hHeap=0x310000) returned 1 [0161.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0161.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0161.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0161.037] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0161.038] WriteFile (in: hFile=0x690, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6a, lpOverlapped=0x0) returned 1 [0161.039] CloseHandle (hObject=0x690) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c70 | out: hHeap=0x310000) returned 1 [0161.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0161.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0161.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0161.040] CryptDestroyKey (hKey=0x52619c8) returned 1 [0161.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0161.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3999d8 | out: hHeap=0x310000) returned 1 [0161.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a48 | out: hHeap=0x310000) returned 1 [0161.040] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0161.040] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0161.040] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.040] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0161.089] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.089] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0161.089] CloseHandle (hObject=0x690) returned 1 [0161.089] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0161.089] RmStartSession () returned 0x0 [0161.090] RmRegisterResources () returned 0x0 [0161.094] RmGetList () returned 0x0 [0161.425] RmShutdown () returned 0x0 [0162.049] RmEndSession () returned 0x0 [0162.425] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261848) returned 1 [0162.425] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0162.425] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0162.425] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0162.425] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0162.425] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=2141433) returned 1 [0162.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0162.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590e020 [0162.448] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0162.448] ReadFile (in: hFile=0x690, lpBuffer=0x590e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x590e040*, lpNumberOfBytesRead=0x2c6f6e8*=0x100000, lpOverlapped=0x0) returned 1 [0162.598] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0162.598] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.598] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.598] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.598] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.599] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.599] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.600] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.600] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.600] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.600] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.600] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.600] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.601] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.601] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.601] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.601] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.601] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.601] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.602] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.602] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.603] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.603] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.604] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.604] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.605] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.605] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.606] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.606] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.607] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.607] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.608] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.608] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.609] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.609] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.610] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.610] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.611] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.611] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.612] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.612] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.613] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.613] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.614] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.614] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.615] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.615] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.616] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.616] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0162.617] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0162.617] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0162.710] WriteFile (in: hFile=0x690, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0162.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590e020 | out: hHeap=0x310000) returned 1 [0164.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0164.601] CloseHandle (hObject=0x690) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0165.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x52039e0 [0165.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0165.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5202cd0 [0165.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52039e0 | out: hHeap=0x310000) returned 1 [0165.418] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.bdcddcbaad"), dwFlags=0x1) returned 1 [0165.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0165.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b500 [0165.421] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3d58 [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] GetLastError () returned 0x0 [0165.421] SetLastError (dwErrCode=0x0) [0165.421] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3d58 | out: hHeap=0x310000) returned 1 [0165.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VNUF", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0165.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VNUF", cchWideChar=4, lpMultiByteStr=0x2c6f520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VNUF", lpUsedDefaultChar=0x0) returned 4 [0165.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0165.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2518 [0165.421] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0165.423] WriteFile (in: hFile=0x690, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x2c6f65c*=0xe57, lpOverlapped=0x0) returned 1 [0165.424] CloseHandle (hObject=0x690) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2518 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5202cd0 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0165.425] CryptDestroyKey (hKey=0x5261848) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0165.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c191f0 | out: hHeap=0x310000) returned 1 [0165.425] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0165.425] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0165.512] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.512] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0165.514] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.514] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0165.514] CloseHandle (hObject=0x450) returned 1 [0165.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0165.514] RmStartSession () returned 0x0 [0166.251] RmRegisterResources () returned 0x0 [0166.254] RmGetList () returned 0x0 [0168.977] RmShutdown () returned 0x0 [0172.376] RmEndSession () returned 0x0 [0172.377] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261848) returned 1 [0172.377] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0172.377] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x20) returned 1 [0172.377] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0172.377] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0172.377] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=69632) returned 1 [0172.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x533d0a8 [0172.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6c75020 [0172.557] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0172.557] ReadFile (in: hFile=0x670, lpBuffer=0x6c75040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6c75040*, lpNumberOfBytesRead=0x2c6f6e8*=0x11000, lpOverlapped=0x0) returned 1 [0172.559] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0172.559] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.559] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.559] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.559] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0172.560] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0172.561] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0172.561] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0172.561] WriteFile (in: hFile=0x670, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0172.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c75020 | out: hHeap=0x310000) returned 1 [0172.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533d0a8 | out: hHeap=0x310000) returned 1 [0172.607] CloseHandle (hObject=0x670) returned 1 [0172.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0172.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321198 [0172.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0172.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0172.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321198 | out: hHeap=0x310000) returned 1 [0172.609] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0172.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4088 [0172.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0172.610] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0172.610] GetLastError () returned 0x0 [0172.610] SetLastError (dwErrCode=0x0) [0172.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3c48 [0172.610] GetLastError () returned 0x0 [0172.610] SetLastError (dwErrCode=0x0) [0172.610] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.611] SetLastError (dwErrCode=0x0) [0172.611] GetLastError () returned 0x0 [0172.614] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b500 [0172.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0172.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0172.615] GetLastError () returned 0x0 [0172.615] SetLastError (dwErrCode=0x0) [0172.615] GetLastError () returned 0x0 [0172.616] SetLastError (dwErrCode=0x0) [0172.616] GetLastError () returned 0x0 [0172.616] SetLastError (dwErrCode=0x0) [0172.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3c48 | out: hHeap=0x310000) returned 1 [0172.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0172.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x38c3b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UEjFQfiUE0cHCwyiRVml9x2esrd", lpUsedDefaultChar=0x0) returned 27 [0172.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0172.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0172.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0172.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0172.616] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0172.617] WriteFile (in: hFile=0x670, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6e, lpOverlapped=0x0) returned 1 [0172.618] CloseHandle (hObject=0x670) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4088 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0172.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0172.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0172.619] CryptDestroyKey (hKey=0x5261848) returned 1 [0172.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0172.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0172.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365ae8 | out: hHeap=0x310000) returned 1 [0172.619] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0172.619] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0172.619] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.619] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0172.665] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.665] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0172.665] CloseHandle (hObject=0x670) returned 1 [0172.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5333608 [0172.665] RmStartSession () returned 0x0 [0173.046] RmRegisterResources () returned 0x0 [0173.050] RmGetList () returned 0x0 [0173.760] RmShutdown () returned 0x0 [0174.815] RmEndSession () returned 0x0 [0174.817] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261388) returned 1 [0174.817] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0174.817] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0174.817] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0174.817] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0174.817] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=1052672) returned 1 [0174.817] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x533d0a8 [0174.818] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6e97020 [0175.641] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0175.641] ReadFile (in: hFile=0x670, lpBuffer=0x6e97040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6e97040*, lpNumberOfBytesRead=0x2c6f6e8*=0x100000, lpOverlapped=0x0) returned 1 [0175.659] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0175.659] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.659] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.659] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.659] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.659] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.659] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.659] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.660] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.660] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.660] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.660] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.660] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.660] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.660] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.660] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.660] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.660] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.661] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.661] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.661] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.661] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.661] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.661] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.661] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.661] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.661] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.661] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.662] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.662] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.662] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.662] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.662] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.662] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.663] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.663] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.663] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.663] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.663] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.663] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.663] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.663] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.663] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.663] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.664] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.664] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.664] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.664] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.664] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.664] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.664] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.664] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.664] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.664] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.665] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.665] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.665] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.665] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.666] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.666] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.666] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.666] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.666] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.666] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.667] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.667] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.667] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.667] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.667] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.667] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.667] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.667] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.667] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.667] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.668] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.668] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.668] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.668] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.668] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.668] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.668] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.668] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.668] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.668] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.669] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.669] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.669] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.669] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.669] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.669] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.669] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.669] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.669] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.669] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.670] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.670] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.670] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.670] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.670] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.670] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.670] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.670] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.670] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.670] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.671] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.671] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.671] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.671] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.671] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.671] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.671] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.671] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.671] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.671] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.672] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.672] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.672] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.672] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.672] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.672] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.672] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.672] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.672] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.672] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.673] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.673] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.673] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.673] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.673] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.674] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.674] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.674] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.674] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.674] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.674] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.674] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.674] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.674] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.674] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.675] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.675] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.675] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.675] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.675] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.675] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.676] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.676] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.676] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.676] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.676] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.676] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.676] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.676] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.677] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.677] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.678] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.678] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.679] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.679] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0175.680] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.247] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.247] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.247] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.247] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.247] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.247] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.247] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.247] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.247] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.248] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.249] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.249] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.249] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.249] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.249] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0176.249] WriteFile (in: hFile=0x670, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0176.249] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0176.249] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0176.258] WriteFile (in: hFile=0x670, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0176.258] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6e97020 | out: hHeap=0x310000) returned 1 [0176.592] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533d0a8 | out: hHeap=0x310000) returned 1 [0176.592] CloseHandle (hObject=0x670) returned 1 [0176.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0176.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x5337dd0 [0176.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4bbacd0 [0176.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x53377e8 [0176.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5337dd0 | out: hHeap=0x310000) returned 1 [0176.614] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0176.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4bbad88 [0176.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0176.615] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0176.615] GetLastError () returned 0x0 [0176.615] SetLastError (dwErrCode=0x0) [0176.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3d58 [0176.615] GetLastError () returned 0x0 [0176.615] SetLastError (dwErrCode=0x0) [0176.615] GetLastError () returned 0x0 [0176.615] SetLastError (dwErrCode=0x0) [0176.615] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] GetLastError () returned 0x0 [0176.616] SetLastError (dwErrCode=0x0) [0176.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0176.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3d58 | out: hHeap=0x310000) returned 1 [0176.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x2c6f520, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0176.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0176.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0176.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397de0 [0176.616] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0176.617] WriteFile (in: hFile=0x670, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5b, lpOverlapped=0x0) returned 1 [0176.618] CloseHandle (hObject=0x670) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397de0 | out: hHeap=0x310000) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbad88 | out: hHeap=0x310000) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53377e8 | out: hHeap=0x310000) returned 1 [0176.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbacd0 | out: hHeap=0x310000) returned 1 [0176.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0176.619] CryptDestroyKey (hKey=0x5261388) returned 1 [0176.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5333608 | out: hHeap=0x310000) returned 1 [0176.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3909a0 | out: hHeap=0x310000) returned 1 [0176.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6600 | out: hHeap=0x310000) returned 1 [0176.619] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0176.619] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0176.619] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.619] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0176.933] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.933] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0176.933] CloseHandle (hObject=0x670) returned 1 [0176.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0176.934] RmStartSession () returned 0x0 [0177.370] RmRegisterResources () returned 0x0 [0177.374] RmGetList () returned 0x0 [0177.713] RmShutdown () returned 0x0 [0181.421] RmEndSession () returned 0x0 [0181.879] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261488) returned 1 [0181.879] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0181.880] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0181.880] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0181.880] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0181.880] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=69632) returned 1 [0181.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd40c8 [0181.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x583b020 [0181.899] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0181.899] ReadFile (in: hFile=0x49c, lpBuffer=0x583b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x583b040*, lpNumberOfBytesRead=0x2c6f6e8*=0x11000, lpOverlapped=0x0) returned 1 [0181.953] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0181.953] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.953] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.954] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.954] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.955] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.955] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0181.955] WriteFile (in: hFile=0x49c, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0181.958] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0181.958] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0181.958] WriteFile (in: hFile=0x49c, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0181.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x583b020 | out: hHeap=0x310000) returned 1 [0181.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd40c8 | out: hHeap=0x310000) returned 1 [0181.964] CloseHandle (hObject=0x49c) returned 1 [0182.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0182.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5328138 [0182.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0182.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327c78 [0182.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5328138 | out: hHeap=0x310000) returned 1 [0182.502] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0182.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0182.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0182.503] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0182.503] GetLastError () returned 0x0 [0182.503] SetLastError (dwErrCode=0x0) [0182.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0182.503] GetLastError () returned 0x0 [0182.503] SetLastError (dwErrCode=0x0) [0182.503] GetLastError () returned 0x0 [0182.503] SetLastError (dwErrCode=0x0) [0182.503] GetLastError () returned 0x0 [0182.503] SetLastError (dwErrCode=0x0) [0182.503] GetLastError () returned 0x0 [0182.503] SetLastError (dwErrCode=0x0) [0182.503] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.504] GetLastError () returned 0x0 [0182.504] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0182.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] GetLastError () returned 0x0 [0182.505] SetLastError (dwErrCode=0x0) [0182.505] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab818 [0182.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0182.506] GetLastError () returned 0x0 [0182.506] SetLastError (dwErrCode=0x0) [0182.506] GetLastError () returned 0x0 [0182.506] SetLastError (dwErrCode=0x0) [0182.506] GetLastError () returned 0x0 [0182.506] SetLastError (dwErrCode=0x0) [0182.506] GetLastError () returned 0x0 [0182.506] SetLastError (dwErrCode=0x0) [0182.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0182.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0182.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0182.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x38c480, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YymLG954e9jSNEr4fGTQUdOu0cPg", lpUsedDefaultChar=0x0) returned 28 [0182.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab818 | out: hHeap=0x310000) returned 1 [0182.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540d6a0 [0182.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5410238 [0182.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0182.506] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0182.507] WriteFile (in: hFile=0x49c, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6f, lpOverlapped=0x0) returned 1 [0182.508] CloseHandle (hObject=0x49c) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327c78 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0182.509] CryptDestroyKey (hKey=0x5261488) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea720 | out: hHeap=0x310000) returned 1 [0182.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e65b0 | out: hHeap=0x310000) returned 1 [0182.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0182.510] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0182.510] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.510] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0182.512] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.512] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0182.512] CloseHandle (hObject=0x49c) returned 1 [0182.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0182.512] RmStartSession () returned 0x0 [0183.150] RmRegisterResources () returned 0x0 [0183.154] RmGetList () returned 0x0 [0183.691] RmShutdown () returned 0x0 [0188.681] RmEndSession () returned 0x0 [0188.682] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261248) returned 1 [0188.682] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0188.682] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0188.682] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.682] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0188.682] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=69632) returned 1 [0188.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x60f60a0 [0188.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6998020 [0189.070] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0189.070] ReadFile (in: hFile=0x518, lpBuffer=0x6998040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6998040*, lpNumberOfBytesRead=0x2c6f6e8*=0x11000, lpOverlapped=0x0) returned 1 [0189.072] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0189.072] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.072] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.072] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.073] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60f60c0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0189.073] WriteFile (in: hFile=0x518, lpBuffer=0x60f60c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x60f60c0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0189.074] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0189.074] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0189.074] WriteFile (in: hFile=0x518, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0189.074] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6998020 | out: hHeap=0x310000) returned 1 [0189.675] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60f60a0 | out: hHeap=0x310000) returned 1 [0189.675] CloseHandle (hObject=0x518) returned 1 [0189.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0189.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0189.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0189.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0189.677] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0189.677] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0189.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0189.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0189.678] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0189.678] GetLastError () returned 0x0 [0189.678] SetLastError (dwErrCode=0x0) [0189.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0189.678] GetLastError () returned 0x0 [0189.678] SetLastError (dwErrCode=0x0) [0189.678] GetLastError () returned 0x0 [0189.678] SetLastError (dwErrCode=0x0) [0189.678] GetLastError () returned 0x0 [0189.678] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] GetLastError () returned 0x0 [0189.679] SetLastError (dwErrCode=0x0) [0189.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba40 [0189.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.680] GetLastError () returned 0x0 [0189.680] SetLastError (dwErrCode=0x0) [0189.680] GetLastError () returned 0x0 [0189.680] SetLastError (dwErrCode=0x0) [0189.680] GetLastError () returned 0x0 [0189.680] SetLastError (dwErrCode=0x0) [0189.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0189.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x38c3b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3p1r5Y6j1RhQxDJosxt", lpUsedDefaultChar=0x0) returned 19 [0189.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0189.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540b990 [0189.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5410238 [0189.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0189.680] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.681] WriteFile (in: hFile=0x518, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x2c6f65c*=0xe66, lpOverlapped=0x0) returned 1 [0189.682] CloseHandle (hObject=0x518) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0189.682] CryptDestroyKey (hKey=0x5261248) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9ea0 | out: hHeap=0x310000) returned 1 [0189.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6a60 | out: hHeap=0x310000) returned 1 [0189.682] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0189.682] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.683] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.683] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0189.685] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.685] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0189.685] CloseHandle (hObject=0x518) returned 1 [0189.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0798 [0189.685] RmStartSession () returned 0x0 [0189.687] RmRegisterResources () returned 0x0 [0189.691] RmGetList () returned 0x0 [0189.998] RmShutdown () returned 0x0 [0193.581] RmEndSession () returned 0x0 [0193.582] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260fc8) returned 1 [0193.582] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0193.582] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0193.582] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.582] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0193.582] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=69632) returned 1 [0193.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5421cf8 [0193.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c28020 [0193.846] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0193.846] ReadFile (in: hFile=0x518, lpBuffer=0x4c28040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4c28040*, lpNumberOfBytesRead=0x2c6f6e8*=0x11000, lpOverlapped=0x0) returned 1 [0193.848] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0193.848] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.848] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.849] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.849] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421d00*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0193.850] WriteFile (in: hFile=0x518, lpBuffer=0x5421d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5421d00*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0193.850] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0193.850] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0193.850] WriteFile (in: hFile=0x518, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0193.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c28020 | out: hHeap=0x310000) returned 1 [0193.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5421cf8 | out: hHeap=0x310000) returned 1 [0193.926] CloseHandle (hObject=0x518) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0810 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0193.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0193.929] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0193.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0193.929] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0193.929] GetLastError () returned 0x0 [0193.930] SetLastError (dwErrCode=0x0) [0193.930] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0193.930] GetLastError () returned 0x0 [0193.930] SetLastError (dwErrCode=0x0) [0193.930] GetLastError () returned 0x0 [0193.930] SetLastError (dwErrCode=0x0) [0193.930] GetLastError () returned 0x0 [0193.930] SetLastError (dwErrCode=0x0) [0193.930] GetLastError () returned 0x0 [0193.930] SetLastError (dwErrCode=0x0) [0193.930] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0193.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x2c6f520, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwY", lpUsedDefaultChar=0x0) returned 3 [0193.930] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540d6a0 [0193.930] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0193.930] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.931] WriteFile (in: hFile=0x518, lpBuffer=0x540d6a0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x540d6a0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe56, lpOverlapped=0x0) returned 1 [0193.932] CloseHandle (hObject=0x518) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0810 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0193.932] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0193.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44a38 | out: hHeap=0x310000) returned 1 [0193.932] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0193.932] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.933] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.933] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0193.944] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.944] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0193.944] CloseHandle (hObject=0x518) returned 1 [0193.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136328 [0193.944] RmStartSession () returned 0x0 [0194.145] RmRegisterResources () returned 0x0 [0194.149] RmGetList () returned 0x0 [0194.866] RmShutdown () returned 0x0 [0195.461] RmEndSession () returned 0x0 [0195.585] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261048) returned 1 [0195.585] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0195.585] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml", dwFileAttributes=0x20) returned 1 [0195.585] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0195.585] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0195.585] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=4782) returned 1 [0195.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x611de98 [0195.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589d020 [0195.605] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0195.605] ReadFile (in: hFile=0x650, lpBuffer=0x589d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x589d040*, lpNumberOfBytesRead=0x2c6f6e8*=0x12ae, lpOverlapped=0x0) returned 1 [0195.647] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0195.647] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x611dea0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x611dea0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0195.647] WriteFile (in: hFile=0x650, lpBuffer=0x611dea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x611dea0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0195.648] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0195.648] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0195.648] WriteFile (in: hFile=0x650, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0195.648] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589d020 | out: hHeap=0x310000) returned 1 [0195.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x611de98 | out: hHeap=0x310000) returned 1 [0195.746] CloseHandle (hObject=0x650) returned 1 [0195.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0195.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5424e60 [0195.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7afc8 [0195.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5423f88 [0195.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5424e60 | out: hHeap=0x310000) returned 1 [0195.747] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0195.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7a0b0 [0195.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc918 [0195.748] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cca28 [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.748] GetLastError () returned 0x0 [0195.748] SetLastError (dwErrCode=0x0) [0195.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0195.749] GetLastError () returned 0x0 [0195.749] SetLastError (dwErrCode=0x0) [0195.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cca28 | out: hHeap=0x310000) returned 1 [0195.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0195.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x2c6f520, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2gHNuRbsv", lpUsedDefaultChar=0x0) returned 9 [0195.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0195.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0195.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0195.749] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0195.750] WriteFile (in: hFile=0x650, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5c, lpOverlapped=0x0) returned 1 [0195.751] CloseHandle (hObject=0x650) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc918 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7a0b0 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5423f88 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7afc8 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0195.751] CryptDestroyKey (hKey=0x5261048) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136328 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3912f8 | out: hHeap=0x310000) returned 1 [0195.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44d08 | out: hHeap=0x310000) returned 1 [0195.751] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0195.751] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0195.751] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.751] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0195.758] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.758] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0195.758] CloseHandle (hObject=0x650) returned 1 [0195.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356bb8 [0195.759] RmStartSession () returned 0x0 [0195.760] RmRegisterResources () returned 0x0 [0195.764] RmGetList () returned 0x0 [0196.278] RmShutdown () returned 0x0 [0198.086] RmEndSession () returned 0x0 [0198.087] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e48) returned 1 [0198.087] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0198.088] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0198.088] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.088] CryptDestroyKey (hKey=0x5260e48) returned 1 [0198.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356bb8 | out: hHeap=0x310000) returned 1 [0198.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92388 | out: hHeap=0x310000) returned 1 [0198.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c081e0 | out: hHeap=0x310000) returned 1 [0198.088] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0198.088] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0198.089] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.089] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0198.091] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.091] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0198.091] CloseHandle (hObject=0x650) returned 1 [0198.091] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8e68 [0198.091] RmStartSession () returned 0x0 [0198.094] RmRegisterResources () returned 0x0 [0198.480] RmGetList () returned 0x0 [0199.704] RmShutdown () returned 0x0 [0202.663] RmEndSession () returned 0x0 [0202.664] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x35da48) returned 1 [0202.664] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0202.664] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", dwFileAttributes=0x20) returned 0 [0202.664] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0202.664] CryptDestroyKey (hKey=0x35da48) returned 1 [0202.664] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8e68 | out: hHeap=0x310000) returned 1 [0202.664] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c318 | out: hHeap=0x310000) returned 1 [0202.664] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07d30 | out: hHeap=0x310000) returned 1 [0202.664] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0202.664] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0202.665] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.665] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0202.705] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.705] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0202.705] CloseHandle (hObject=0x650) returned 1 [0202.705] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92ac0 [0202.705] RmStartSession () returned 0x0 [0202.707] RmRegisterResources () returned 0x0 [0202.711] RmGetList () returned 0x0 [0207.217] RmShutdown () returned 0x0 [0207.899] RmEndSession () returned 0x0 [0207.900] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261908) returned 1 [0207.900] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0207.900] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0207.900] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.900] CryptDestroyKey (hKey=0x5261908) returned 1 [0207.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92ac0 | out: hHeap=0x310000) returned 1 [0207.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c932a0 | out: hHeap=0x310000) returned 1 [0207.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07fb0 | out: hHeap=0x310000) returned 1 [0207.900] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0207.900] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0207.901] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.901] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0207.905] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.905] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0207.905] CloseHandle (hObject=0x650) returned 1 [0207.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ea850 [0207.905] RmStartSession () returned 0x0 [0207.907] RmRegisterResources () returned 0x0 [0207.911] RmGetList () returned 0x0 [0212.087] RmShutdown () returned 0x0 [0212.380] RmEndSession () returned 0x0 [0212.381] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e48) returned 1 [0212.381] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0212.381] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", dwFileAttributes=0x20) returned 0 [0212.381] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.382] CryptDestroyKey (hKey=0x5260e48) returned 1 [0212.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ea850 | out: hHeap=0x310000) returned 1 [0212.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc888 | out: hHeap=0x310000) returned 1 [0212.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a57e0 | out: hHeap=0x310000) returned 1 [0212.382] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0212.382] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0212.382] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.382] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0212.430] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.430] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0212.430] CloseHandle (hObject=0x650) returned 1 [0212.430] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0212.430] RmStartSession () returned 0x0 [0212.432] RmRegisterResources () returned 0x0 [0212.433] RmGetList () returned 0x0 [0213.358] RmShutdown () returned 0x0 [0215.554] RmEndSession () returned 0x0 [0216.418] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260cc8) returned 1 [0216.419] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0216.419] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0216.419] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.419] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0216.419] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0216.419] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0216.419] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5600 | out: hHeap=0x310000) returned 1 [0216.419] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0216.419] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0216.419] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.420] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0216.456] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.456] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0216.456] CloseHandle (hObject=0x664) returned 1 [0216.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bcc30 [0216.456] RmStartSession () returned 0x0 [0216.458] RmRegisterResources () returned 0x0 [0216.458] RmGetList () returned 0x0 [0217.361] RmShutdown () returned 0x0 [0218.409] RmEndSession () returned 0x0 [0218.410] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261308) returned 1 [0218.410] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0218.410] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml", dwFileAttributes=0x20) returned 0 [0218.410] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.410] CryptDestroyKey (hKey=0x5261308) returned 1 [0218.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bcc30 | out: hHeap=0x310000) returned 1 [0218.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb9b8 | out: hHeap=0x310000) returned 1 [0218.411] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a60f0 | out: hHeap=0x310000) returned 1 [0218.411] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0218.411] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0218.411] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.411] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0218.446] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.446] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0218.446] CloseHandle (hObject=0x664) returned 1 [0218.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bcc30 [0218.446] RmStartSession () returned 0x0 [0218.448] RmRegisterResources () returned 0x0 [0218.452] RmGetList () returned 0x0 [0218.730] RmShutdown () returned 0x0 [0220.263] RmEndSession () returned 0x0 [0220.264] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260f08) returned 1 [0220.264] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0220.264] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml", dwFileAttributes=0x20) returned 0 [0220.264] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.264] CryptDestroyKey (hKey=0x5260f08) returned 1 [0220.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bcc30 | out: hHeap=0x310000) returned 1 [0220.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb710 | out: hHeap=0x310000) returned 1 [0220.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5fb0 | out: hHeap=0x310000) returned 1 [0220.264] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0220.264] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0220.264] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.265] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0220.284] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.284] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0220.284] CloseHandle (hObject=0x664) returned 1 [0220.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0220.285] RmStartSession () returned 0x0 [0220.286] RmRegisterResources () returned 0x0 [0220.286] RmGetList () returned 0x0 [0222.113] RmShutdown () returned 0x0 [0226.479] RmEndSession () returned 0x0 [0226.480] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261048) returned 1 [0226.480] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0226.480] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0226.480] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.480] CryptDestroyKey (hKey=0x5261048) returned 1 [0226.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0226.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0226.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14290 | out: hHeap=0x310000) returned 1 [0226.480] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0226.480] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0226.500] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.500] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0226.502] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.502] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0226.502] CloseHandle (hObject=0x688) returned 1 [0226.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0226.502] RmStartSession () returned 0x0 [0226.504] RmRegisterResources () returned 0x0 [0226.508] RmGetList () returned 0x0 [0227.820] RmShutdown () returned 0x0 [0229.724] RmEndSession () returned 0x0 [0229.805] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e08) returned 1 [0229.805] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0229.805] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", dwFileAttributes=0x20) returned 0 [0229.806] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.806] CryptDestroyKey (hKey=0x5260e08) returned 1 [0229.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0229.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39bef0 | out: hHeap=0x310000) returned 1 [0229.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14e70 | out: hHeap=0x310000) returned 1 [0229.806] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0229.806] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0229.806] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.806] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0229.812] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.812] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0229.812] CloseHandle (hObject=0x688) returned 1 [0229.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0229.812] RmStartSession () returned 0x0 [0229.963] RmRegisterResources () returned 0x0 [0229.964] RmGetList () returned 0x0 [0230.155] RmShutdown () returned 0x0 [0231.542] RmEndSession () returned 0x0 [0231.911] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261ac8) returned 1 [0231.911] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0231.911] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", dwFileAttributes=0x20) returned 0 [0231.911] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.911] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0231.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0231.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571640 | out: hHeap=0x310000) returned 1 [0231.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19100 | out: hHeap=0x310000) returned 1 [0231.911] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0231.911] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0231.912] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.912] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0231.951] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.951] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0231.952] CloseHandle (hObject=0x680) returned 1 [0231.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0231.952] RmStartSession () returned 0x0 [0231.956] RmRegisterResources () returned 0x0 [0231.956] RmGetList () returned 0x0 [0232.583] RmShutdown () returned 0x0 [0234.808] RmEndSession () returned 0x0 [0234.808] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x52613c8) returned 1 [0234.808] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0234.809] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", dwFileAttributes=0x20) returned 0 [0234.809] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.809] CryptDestroyKey (hKey=0x52613c8) returned 1 [0234.809] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0234.809] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0234.809] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572888 | out: hHeap=0x310000) returned 1 [0234.809] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0234.809] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0234.809] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.809] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0234.837] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.837] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0234.837] CloseHandle (hObject=0x680) returned 1 [0234.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d196f0 [0234.837] RmStartSession () returned 0x0 [0234.841] RmRegisterResources () returned 0x0 [0234.844] RmGetList () returned 0x0 [0237.661] RmShutdown () returned 0x0 [0238.997] RmEndSession () returned 0x0 [0239.152] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x52616c8) returned 1 [0239.153] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0239.153] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl", dwFileAttributes=0x20) returned 1 [0239.153] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0239.153] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0239.153] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=187392) returned 1 [0239.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5cf70 [0239.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b2020 [0239.298] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0239.298] ReadFile (in: hFile=0x680, lpBuffer=0x64b2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x64b2040*, lpNumberOfBytesRead=0x2c6f6e8*=0x2dc00, lpOverlapped=0x0) returned 1 [0239.364] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0239.364] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.365] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.365] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.365] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.365] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.365] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.365] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.365] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.365] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.365] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.365] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.366] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.366] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.366] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.366] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.366] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.366] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.367] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.367] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.367] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.367] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.367] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.367] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.368] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.369] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0239.369] WriteFile (in: hFile=0x680, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0239.369] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0239.369] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0239.369] WriteFile (in: hFile=0x680, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0239.369] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b2020 | out: hHeap=0x310000) returned 1 [0239.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5cf70 | out: hHeap=0x310000) returned 1 [0239.375] CloseHandle (hObject=0x680) returned 1 [0239.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0239.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0239.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a500 [0239.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0239.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0239.375] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.bdcddcbaad"), dwFlags=0x1) returned 1 [0239.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ee8 [0239.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0239.376] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.376] GetLastError () returned 0x0 [0239.376] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b810 [0239.377] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0239.377] SetLastError (dwErrCode=0x0) [0239.377] GetLastError () returned 0x0 [0240.043] SetLastError (dwErrCode=0x0) [0240.043] GetLastError () returned 0x0 [0240.043] SetLastError (dwErrCode=0x0) [0240.043] GetLastError () returned 0x0 [0240.043] SetLastError (dwErrCode=0x0) [0240.043] GetLastError () returned 0x0 [0240.043] SetLastError (dwErrCode=0x0) [0240.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0240.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0240.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0240.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x38c520, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LUpoh1S64gDKMZE4Tnpz2A", lpUsedDefaultChar=0x0) returned 22 [0240.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b810 | out: hHeap=0x310000) returned 1 [0240.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0240.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0240.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0240.044] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0240.044] WriteFile (in: hFile=0x56c, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2c6f65c*=0xe69, lpOverlapped=0x0) returned 1 [0240.045] CloseHandle (hObject=0x56c) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ee8 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a500 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0240.045] CryptDestroyKey (hKey=0x52616c8) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b148 | out: hHeap=0x310000) returned 1 [0240.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55723d8 | out: hHeap=0x310000) returned 1 [0240.045] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0240.046] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0240.046] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.046] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0240.054] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.054] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0240.054] CloseHandle (hObject=0x56c) returned 1 [0240.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0240.054] RmStartSession () returned 0x0 [0240.357] RmRegisterResources () returned 0x0 [0240.358] RmGetList () returned 0x0 [0240.396] RmShutdown () returned 0x0 [0241.988] RmEndSession () returned 0x0 [0242.155] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261188) returned 1 [0242.155] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0242.155] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties", dwFileAttributes=0x20) returned 1 [0242.155] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0242.155] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0242.155] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=3752) returned 1 [0242.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0242.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d32020 [0242.262] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0242.262] ReadFile (in: hFile=0x574, lpBuffer=0x4d32040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4d32040*, lpNumberOfBytesRead=0x2c6f6e8*=0xea8, lpOverlapped=0x0) returned 1 [0242.296] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0242.296] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0242.296] WriteFile (in: hFile=0x574, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0242.296] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0242.296] WriteFile (in: hFile=0x574, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0242.296] WriteFile (in: hFile=0x574, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0242.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d32020 | out: hHeap=0x310000) returned 1 [0242.301] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0242.301] CloseHandle (hObject=0x574) returned 1 [0242.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0242.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcf00 [0242.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0242.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbf30 [0242.301] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0242.301] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0242.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0242.302] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0242.302] GetLastError () returned 0x0 [0242.302] SetLastError (dwErrCode=0x0) [0242.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0242.302] GetLastError () returned 0x0 [0242.302] SetLastError (dwErrCode=0x0) [0242.302] GetLastError () returned 0x0 [0242.302] SetLastError (dwErrCode=0x0) [0242.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0242.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0242.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x2c6f520, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0242.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0242.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0242.303] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0242.303] WriteFile (in: hFile=0x574, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe54, lpOverlapped=0x0) returned 1 [0242.304] CloseHandle (hObject=0x574) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0242.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0242.304] CryptDestroyKey (hKey=0x5261188) returned 1 [0242.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0242.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee738 | out: hHeap=0x310000) returned 1 [0242.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572838 | out: hHeap=0x310000) returned 1 [0242.305] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0242.305] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0242.305] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.305] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0242.354] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.354] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0242.354] CloseHandle (hObject=0x574) returned 1 [0242.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d196f0 [0242.355] RmStartSession () returned 0x0 [0242.528] RmRegisterResources () returned 0x0 [0242.528] RmGetList () returned 0x0 [0243.487] RmShutdown () returned 0x0 [0244.392] RmEndSession () returned 0x0 [0244.393] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261488) returned 1 [0244.393] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0244.393] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index", dwFileAttributes=0x20) returned 1 [0244.393] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0244.393] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0244.394] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=1461) returned 1 [0244.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0244.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0244.697] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.697] GetLastError () returned 0x0 [0244.697] SetLastError (dwErrCode=0x0) [0244.698] GetLastError () returned 0x0 [0244.698] SetLastError (dwErrCode=0x0) [0244.698] GetLastError () returned 0x0 [0244.698] SetLastError (dwErrCode=0x0) [0244.698] GetLastError () returned 0x0 [0244.698] SetLastError (dwErrCode=0x0) [0244.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0244.698] GetLastError () returned 0x0 [0244.698] SetLastError (dwErrCode=0x0) [0244.698] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0244.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0244.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x2c6f520, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0244.698] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0244.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0244.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0244.698] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0244.699] WriteFile (in: hFile=0x564, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5c, lpOverlapped=0x0) returned 1 [0244.700] CloseHandle (hObject=0x564) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19b28 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0244.700] CryptDestroyKey (hKey=0x5261488) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a390 | out: hHeap=0x310000) returned 1 [0244.700] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352330 | out: hHeap=0x310000) returned 1 [0244.700] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0244.700] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0244.700] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.700] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0244.705] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.705] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0244.705] CloseHandle (hObject=0x564) returned 1 [0244.705] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0244.705] RmStartSession () returned 0x0 [0244.708] RmRegisterResources () returned 0x0 [0244.708] RmGetList () returned 0x0 [0245.467] RmShutdown () returned 0x0 [0247.697] RmEndSession () returned 0x0 [0247.698] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261348) returned 1 [0247.698] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0247.698] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src", dwFileAttributes=0x20) returned 1 [0247.698] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0247.698] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0247.698] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=10568) returned 1 [0247.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0247.698] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f8020 [0250.073] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.073] SetLastError (dwErrCode=0x0) [0250.073] GetLastError () returned 0x0 [0250.074] SetLastError (dwErrCode=0x0) [0250.074] GetLastError () returned 0x0 [0250.074] SetLastError (dwErrCode=0x0) [0250.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0250.074] GetLastError () returned 0x0 [0250.074] SetLastError (dwErrCode=0x0) [0250.074] GetLastError () returned 0x0 [0250.074] SetLastError (dwErrCode=0x0) [0250.074] GetLastError () returned 0x0 [0250.074] SetLastError (dwErrCode=0x0) [0250.074] GetLastError () returned 0x0 [0250.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0250.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0250.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x38c160, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mq0Gric0JR23PHFSN5QG4V5474", lpUsedDefaultChar=0x0) returned 26 [0250.074] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ed650 | out: hHeap=0x310000) returned 1 [0250.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0250.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0250.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0250.074] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0250.075] WriteFile (in: hFile=0x564, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6d, lpOverlapped=0x0) returned 1 [0250.076] CloseHandle (hObject=0x564) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391838 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0250.076] CryptDestroyKey (hKey=0x5261348) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570f20 | out: hHeap=0x310000) returned 1 [0250.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53528d0 | out: hHeap=0x310000) returned 1 [0250.076] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0250.076] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0250.077] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.077] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0250.089] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.089] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0250.089] CloseHandle (hObject=0x564) returned 1 [0250.089] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ba0 [0250.089] RmStartSession () returned 0x0 [0250.090] RmRegisterResources () returned 0x0 [0250.094] RmGetList () returned 0x0 [0250.503] RmShutdown () returned 0x0 [0251.702] RmEndSession () returned 0x0 [0251.703] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261648) returned 1 [0251.703] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0251.703] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", dwFileAttributes=0x20) returned 1 [0251.703] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0251.703] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0251.703] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=4226) returned 1 [0251.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0251.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6217020 [0252.051] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0252.051] ReadFile (in: hFile=0x564, lpBuffer=0x6217040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x6217040*, lpNumberOfBytesRead=0x2c6f6e8*=0x1082, lpOverlapped=0x0) returned 1 [0252.052] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0252.052] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0252.052] WriteFile (in: hFile=0x564, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0252.053] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0252.053] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0252.053] WriteFile (in: hFile=0x564, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0252.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6217020 | out: hHeap=0x310000) returned 1 [0255.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bae030 | out: hHeap=0x310000) returned 1 [0255.434] CloseHandle (hObject=0x564) returned 1 [0255.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0255.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0255.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0255.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0255.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0255.435] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.bdcddcbaad"), dwFlags=0x1) returned 1 [0255.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0255.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0255.435] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0255.435] GetLastError () returned 0x0 [0255.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0255.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x2c6f520, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx231C421W", lpUsedDefaultChar=0x0) returned 10 [0255.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0255.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0255.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0255.436] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0255.437] WriteFile (in: hFile=0x564, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe5d, lpOverlapped=0x0) returned 1 [0255.438] CloseHandle (hObject=0x564) returned 1 [0255.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0255.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0255.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0255.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0255.439] CryptDestroyKey (hKey=0x5261648) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39580 | out: hHeap=0x310000) returned 1 [0255.439] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53532d0 | out: hHeap=0x310000) returned 1 [0255.439] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0255.439] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0255.439] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.439] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0255.441] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.441] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0255.441] CloseHandle (hObject=0x564) returned 1 [0255.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0255.441] RmStartSession () returned 0x0 [0255.443] RmRegisterResources () returned 0x0 [0255.447] RmGetList () returned 0x0 [0256.131] RmShutdown () returned 0x0 [0256.667] RmEndSession () returned 0x0 [0256.668] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261448) returned 1 [0256.668] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0256.668] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", dwFileAttributes=0x20) returned 1 [0256.669] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0256.669] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0256.669] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=63933) returned 1 [0256.669] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b6b008 [0256.669] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5818020 [0256.715] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0256.716] GetLastError () returned 0x0 [0256.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0256.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c4d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0256.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0256.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0256.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0256.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0256.716] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0256.716] WriteFile (in: hFile=0x564, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe64, lpOverlapped=0x0) returned 1 [0256.717] CloseHandle (hObject=0x564) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0256.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0256.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0256.718] CryptDestroyKey (hKey=0x5261448) returned 1 [0256.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0256.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570048 | out: hHeap=0x310000) returned 1 [0256.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352150 | out: hHeap=0x310000) returned 1 [0256.718] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0256.718] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0256.718] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.718] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0256.719] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.719] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0256.719] CloseHandle (hObject=0x564) returned 1 [0256.719] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0256.719] RmStartSession () returned 0x0 [0256.720] RmRegisterResources () returned 0x0 [0256.720] RmGetList () returned 0x0 [0258.334] RmShutdown () returned 0x0 [0260.589] RmEndSession () returned 0x0 [0260.799] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261908) returned 1 [0260.799] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0260.799] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\FileSystemMetadata.xml", dwFileAttributes=0x220) returned 1 [0260.799] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0260.799] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0260.799] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=281) returned 1 [0260.799] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c89228 [0260.800] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e3020 [0260.849] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0260.849] GetLastError () returned 0x0 [0260.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0260.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0260.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c3b8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0260.849] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60fded0 | out: hHeap=0x310000) returned 1 [0260.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0260.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54ec758 [0260.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0260.849] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0260.850] WriteFile (in: hFile=0x564, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2c6f65c*=0xe71, lpOverlapped=0x0) returned 1 [0260.851] CloseHandle (hObject=0x564) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398e80 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0260.851] CryptDestroyKey (hKey=0x5261908) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3ab0 | out: hHeap=0x310000) returned 1 [0260.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351980 | out: hHeap=0x310000) returned 1 [0260.851] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0260.851] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0260.940] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.940] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0260.976] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.976] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0260.976] CloseHandle (hObject=0x670) returned 1 [0260.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f05358 [0260.976] RmStartSession () returned 0x0 [0261.132] RmRegisterResources () returned 0x0 [0261.132] RmGetList () returned 0x0 [0261.350] RmShutdown () returned 0x0 [0262.028] RmEndSession () returned 0x0 [0262.028] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261148) returned 1 [0262.029] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0262.029] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0262.029] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0262.029] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0262.029] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=1261) returned 1 [0262.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c89228 [0262.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bb020 [0262.760] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0262.760] GetLastError () returned 0x0 [0262.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0262.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x2c6f520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0262.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0262.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0262.760] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0262.761] WriteFile (in: hFile=0x640, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe57, lpOverlapped=0x0) returned 1 [0262.762] CloseHandle (hObject=0x640) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04de8 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a07a0 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f045c0 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0262.762] CryptDestroyKey (hKey=0x5261148) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05358 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5347788 | out: hHeap=0x310000) returned 1 [0262.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351f20 | out: hHeap=0x310000) returned 1 [0262.762] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0262.762] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0262.763] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.763] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0262.797] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.797] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0262.797] CloseHandle (hObject=0x640) returned 1 [0262.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f045c0 [0262.797] RmStartSession () returned 0x0 [0263.012] RmRegisterResources () returned 0x0 [0263.013] RmGetList () returned 0x0 [0263.059] RmShutdown () returned 0x0 [0263.980] RmEndSession () returned 0x0 [0263.981] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261248) returned 1 [0263.981] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0263.981] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0263.981] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0263.981] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0263.981] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=9216) returned 1 [0263.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cecf90 [0263.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589c020 [0266.599] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0266.599] GetLastError () returned 0x0 [0266.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x2c6f520, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0266.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0266.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0266.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0266.599] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0266.600] WriteFile (in: hFile=0x56c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2c6f65c*=0xe61, lpOverlapped=0x0) returned 1 [0266.601] CloseHandle (hObject=0x56c) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba6240 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5398e88 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba6328 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0266.601] CryptDestroyKey (hKey=0x5261248) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f045c0 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348268 | out: hHeap=0x310000) returned 1 [0266.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19970 | out: hHeap=0x310000) returned 1 [0266.601] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0266.601] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.604] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.604] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0266.605] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.605] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0266.606] CloseHandle (hObject=0x680) returned 1 [0266.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0266.606] RmStartSession () returned 0x0 [0266.808] RmRegisterResources () returned 0x0 [0266.808] RmGetList () returned 0x0 [0266.881] RmShutdown () returned 0x0 [0269.063] RmEndSession () returned 0x0 [0269.064] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260b88) returned 1 [0269.064] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0269.064] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF", dwFileAttributes=0x220) returned 1 [0269.064] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0269.065] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0269.065] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=9024) returned 1 [0269.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0269.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b02020 [0270.504] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0270.504] GetLastError () returned 0x0 [0270.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0270.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0270.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c480, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0270.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89a50 | out: hHeap=0x310000) returned 1 [0270.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0270.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0270.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0270.504] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0270.505] WriteFile (in: hFile=0x548, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2c6f65c*=0xe6e, lpOverlapped=0x0) returned 1 [0270.506] CloseHandle (hObject=0x548) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0270.506] CryptDestroyKey (hKey=0x5260b88) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571c30 | out: hHeap=0x310000) returned 1 [0270.506] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19010 | out: hHeap=0x310000) returned 1 [0270.506] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0270.506] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0270.507] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.507] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0270.518] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.518] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0270.518] CloseHandle (hObject=0x548) returned 1 [0270.518] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0270.518] RmStartSession () returned 0x0 [0270.521] RmRegisterResources () returned 0x0 [0270.521] RmGetList () returned 0x0 [0272.427] RmShutdown () returned 0x0 [0272.929] RmEndSession () returned 0x0 [0273.009] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e48) returned 1 [0273.009] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0273.009] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF", dwFileAttributes=0x220) returned 1 [0273.009] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0273.009] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0273.009] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=6984) returned 1 [0273.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0273.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d9020 [0273.061] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0273.061] GetLastError () returned 0x0 [0273.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0273.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x2c6f520, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xAw10", lpUsedDefaultChar=0x0) returned 5 [0273.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0273.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0273.061] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0273.062] WriteFile (in: hFile=0x548, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe58, lpOverlapped=0x0) returned 1 [0273.063] CloseHandle (hObject=0x548) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cb070 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0273.063] CryptDestroyKey (hKey=0x5260e48) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5438 | out: hHeap=0x310000) returned 1 [0273.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2eb0 | out: hHeap=0x310000) returned 1 [0273.063] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0273.063] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0273.063] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.064] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0273.103] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.104] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0273.104] CloseHandle (hObject=0x548) returned 1 [0273.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0273.104] RmStartSession () returned 0x0 [0273.106] RmRegisterResources () returned 0x0 [0273.107] RmGetList () returned 0x0 [0273.592] RmShutdown () returned 0x0 [0275.936] RmEndSession () returned 0x0 [0275.937] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260fc8) returned 1 [0275.937] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0275.937] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF", dwFileAttributes=0x220) returned 1 [0275.938] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0275.938] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0275.938] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=4734) returned 1 [0275.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0275.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f0020 [0276.913] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0276.913] GetLastError () returned 0x0 [0276.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0276.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0276.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x38c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terRLaOJV2Dtqoxu0p", lpUsedDefaultChar=0x0) returned 18 [0276.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0276.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0276.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0276.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0276.913] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0276.914] WriteFile (in: hFile=0x548, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2c6f65c*=0xe65, lpOverlapped=0x0) returned 1 [0276.915] CloseHandle (hObject=0x548) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0276.915] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a53a0 | out: hHeap=0x310000) returned 1 [0276.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3310 | out: hHeap=0x310000) returned 1 [0276.915] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0276.915] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0276.916] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.916] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0276.918] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.918] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0276.918] CloseHandle (hObject=0x548) returned 1 [0276.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0276.918] RmStartSession () returned 0x0 [0276.921] RmRegisterResources () returned 0x0 [0276.924] RmGetList () returned 0x0 [0277.911] RmShutdown () returned 0x0 [0278.579] RmEndSession () returned 0x0 [0278.579] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260e48) returned 1 [0278.579] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0278.580] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF", dwFileAttributes=0x220) returned 1 [0278.580] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0278.580] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0278.580] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=2756) returned 1 [0278.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0278.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c4020 [0278.597] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0278.597] ReadFile (in: hFile=0x548, lpBuffer=0x65c4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x65c4040*, lpNumberOfBytesRead=0x2c6f6e8*=0xac4, lpOverlapped=0x0) returned 1 [0278.598] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0278.599] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0278.599] WriteFile (in: hFile=0x548, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0278.599] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0278.599] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0278.599] WriteFile (in: hFile=0x548, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0278.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c4020 | out: hHeap=0x310000) returned 1 [0278.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0278.607] CloseHandle (hObject=0x548) returned 1 [0278.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0278.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0278.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0278.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0278.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0278.608] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0278.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0278.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0278.609] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0278.609] GetLastError () returned 0x0 [0278.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0278.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c3b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0278.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b928 | out: hHeap=0x310000) returned 1 [0278.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0278.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0278.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0278.610] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0278.611] WriteFile (in: hFile=0x548, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe68, lpOverlapped=0x0) returned 1 [0278.612] CloseHandle (hObject=0x548) returned 1 [0278.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0278.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0278.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0278.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0278.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0278.613] CryptDestroyKey (hKey=0x5260e48) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a63a8 | out: hHeap=0x310000) returned 1 [0278.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2230 | out: hHeap=0x310000) returned 1 [0278.613] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0278.613] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0278.613] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.613] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0279.523] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.523] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0279.523] CloseHandle (hObject=0x548) returned 1 [0279.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4988 [0279.523] RmStartSession () returned 0x0 [0279.526] RmRegisterResources () returned 0x0 [0279.526] RmGetList () returned 0x0 [0279.625] RmShutdown () returned 0x0 [0280.878] RmEndSession () returned 0x0 [0280.879] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x35dd08) returned 1 [0280.879] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0280.879] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF", dwFileAttributes=0x220) returned 1 [0280.880] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0280.880] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0280.880] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=3416) returned 1 [0280.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0280.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ea020 [0280.897] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0280.897] ReadFile (in: hFile=0x548, lpBuffer=0x49ea040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x49ea040*, lpNumberOfBytesRead=0x2c6f6e8*=0xd58, lpOverlapped=0x0) returned 1 [0280.897] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0280.897] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0280.897] WriteFile (in: hFile=0x548, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0280.897] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0280.897] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0280.898] WriteFile (in: hFile=0x548, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0280.898] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ea020 | out: hHeap=0x310000) returned 1 [0280.903] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0280.903] CloseHandle (hObject=0x548) returned 1 [0280.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0280.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4b50 [0280.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0280.903] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.903] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4690 [0280.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0280.904] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0280.904] GetLastError () returned 0x0 [0280.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0280.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x38c3b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", lpUsedDefaultChar=0x0) returned 31 [0280.905] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e80630 | out: hHeap=0x310000) returned 1 [0280.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0280.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0280.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.905] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0280.906] WriteFile (in: hFile=0x548, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2c6f65c*=0xe72, lpOverlapped=0x0) returned 1 [0280.906] CloseHandle (hObject=0x548) returned 1 [0280.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4690 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4b50 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0280.907] CryptDestroyKey (hKey=0x35dd08) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4988 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a60b0 | out: hHeap=0x310000) returned 1 [0280.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1b50 | out: hHeap=0x310000) returned 1 [0280.907] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0280.907] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0280.907] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.907] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0280.916] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.916] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0280.916] CloseHandle (hObject=0x548) returned 1 [0280.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5140 [0280.916] RmStartSession () returned 0x0 [0280.917] RmRegisterResources () returned 0x0 [0280.918] RmGetList () returned 0x0 [0283.531] RmShutdown () returned 0x0 [0286.379] RmEndSession () returned 0x0 [0286.380] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260f88) returned 1 [0286.380] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0286.380] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF", dwFileAttributes=0x220) returned 1 [0286.380] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0286.380] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0286.380] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=4996) returned 1 [0286.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0286.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b6020 [0287.027] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0287.027] ReadFile (in: hFile=0x548, lpBuffer=0x64b6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x64b6040*, lpNumberOfBytesRead=0x2c6f6e8*=0x1384, lpOverlapped=0x0) returned 1 [0287.087] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0287.087] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0287.087] WriteFile (in: hFile=0x548, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0287.087] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0287.087] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0287.088] WriteFile (in: hFile=0x548, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0287.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b6020 | out: hHeap=0x310000) returned 1 [0287.093] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0287.093] CloseHandle (hObject=0x548) returned 1 [0287.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0287.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c32f0 [0287.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0287.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2998 [0287.093] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c32f0 | out: hHeap=0x310000) returned 1 [0287.093] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0287.094] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5270 [0287.094] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0287.094] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0287.094] GetLastError () returned 0x0 [0287.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0287.094] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0287.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x38c3e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ROQXe5ltuBK41ZqGEav", lpUsedDefaultChar=0x0) returned 19 [0287.095] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0287.095] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0287.095] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0287.095] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0287.095] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0287.095] WriteFile (in: hFile=0x548, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe66, lpOverlapped=0x0) returned 1 [0287.096] CloseHandle (hObject=0x548) returned 1 [0287.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0287.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0287.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5270 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2998 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0287.097] CryptDestroyKey (hKey=0x5260f88) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5140 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94210 | out: hHeap=0x310000) returned 1 [0287.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2190 | out: hHeap=0x310000) returned 1 [0287.097] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0287.097] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0287.097] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.097] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0287.139] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.139] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0287.139] CloseHandle (hObject=0x548) returned 1 [0287.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0287.139] RmStartSession () returned 0x0 [0287.142] RmRegisterResources () returned 0x0 [0287.142] RmGetList () returned 0x0 [0287.592] RmShutdown () returned 0x0 [0288.369] RmEndSession () returned 0x0 [0288.522] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x52611c8) returned 1 [0288.523] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0288.523] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF", dwFileAttributes=0x220) returned 1 [0288.523] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0288.523] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0288.523] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=12982) returned 1 [0288.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0288.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621a020 [0288.542] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0288.542] ReadFile (in: hFile=0x5c8, lpBuffer=0x621a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x621a040*, lpNumberOfBytesRead=0x2c6f6e8*=0x32b6, lpOverlapped=0x0) returned 1 [0288.606] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0288.606] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0288.606] WriteFile (in: hFile=0x5c8, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0288.607] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0288.607] WriteFile (in: hFile=0x5c8, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0288.607] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0288.607] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0288.607] WriteFile (in: hFile=0x5c8, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0288.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621a020 | out: hHeap=0x310000) returned 1 [0288.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0288.612] CloseHandle (hObject=0x5c8) returned 1 [0288.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0288.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2998 [0288.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6608 [0288.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c38b0 [0288.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2998 | out: hHeap=0x310000) returned 1 [0288.613] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0288.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6148 [0288.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb1c0 [0288.614] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0288.614] GetLastError () returned 0x0 [0288.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0288.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0288.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x38c3e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n02uzHYCkn2cuVUIt7q96r", lpUsedDefaultChar=0x0) returned 22 [0288.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0288.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0288.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0288.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0288.615] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0288.616] WriteFile (in: hFile=0x5c8, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe69, lpOverlapped=0x0) returned 1 [0288.616] CloseHandle (hObject=0x5c8) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb1c0 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6148 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c38b0 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6608 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0288.617] CryptDestroyKey (hKey=0x52611c8) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95770 | out: hHeap=0x310000) returned 1 [0288.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2b40 | out: hHeap=0x310000) returned 1 [0288.617] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0288.617] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0288.617] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.617] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0289.179] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.179] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0289.179] CloseHandle (hObject=0x5c8) returned 1 [0289.179] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a50a8 [0289.179] RmStartSession () returned 0x0 [0289.973] RmRegisterResources () returned 0x0 [0289.974] RmGetList () returned 0x0 [0290.178] RmShutdown () returned 0x0 [0290.670] RmEndSession () returned 0x0 [0290.895] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5260c08) returned 1 [0290.895] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0290.895] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF", dwFileAttributes=0x220) returned 1 [0290.895] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0290.895] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0290.895] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=18304) returned 1 [0290.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0290.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c23020 [0290.915] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0290.915] ReadFile (in: hFile=0x5c8, lpBuffer=0x4c23040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4c23040*, lpNumberOfBytesRead=0x2c6f6e8*=0x4780, lpOverlapped=0x0) returned 1 [0290.993] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0290.993] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0290.993] WriteFile (in: hFile=0x5c8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0290.994] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0290.994] WriteFile (in: hFile=0x5c8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0290.994] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0290.994] WriteFile (in: hFile=0x5c8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0290.994] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0290.994] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0290.994] WriteFile (in: hFile=0x5c8, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0290.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c23020 | out: hHeap=0x310000) returned 1 [0291.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0291.000] CloseHandle (hObject=0x5c8) returned 1 [0291.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0291.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0291.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5698 [0291.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0291.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0291.001] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0291.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5438 [0291.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0291.002] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0291.003] GetLastError () returned 0x0 [0291.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0291.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x2c6f520, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0291.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0291.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0291.003] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0291.004] WriteFile (in: hFile=0x5c8, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2c6f65c*=0xe54, lpOverlapped=0x0) returned 1 [0291.005] CloseHandle (hObject=0x5c8) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5438 | out: hHeap=0x310000) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0291.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5698 | out: hHeap=0x310000) returned 1 [0291.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0291.006] CryptDestroyKey (hKey=0x5260c08) returned 1 [0291.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a50a8 | out: hHeap=0x310000) returned 1 [0291.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b00 | out: hHeap=0x310000) returned 1 [0291.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e24b0 | out: hHeap=0x310000) returned 1 [0291.193] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0291.193] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0291.193] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.193] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0291.195] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.195] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0291.195] CloseHandle (hObject=0x678) returned 1 [0291.195] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5698 [0291.195] RmStartSession () returned 0x0 [0291.302] RmRegisterResources () returned 0x0 [0291.302] RmGetList () returned 0x0 [0291.383] RmShutdown () returned 0x0 [0293.163] RmEndSession () returned 0x0 [0293.243] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x35d708) returned 1 [0293.243] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0293.243] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF", dwFileAttributes=0x220) returned 1 [0293.243] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0293.243] CryptEncrypt (in: hKey=0x35d708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0293.244] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=1536) returned 1 [0293.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0293.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x562c020 [0293.263] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0293.263] ReadFile (in: hFile=0x678, lpBuffer=0x562c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x562c040*, lpNumberOfBytesRead=0x2c6f6e8*=0x600, lpOverlapped=0x0) returned 1 [0293.263] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0293.263] CryptEncrypt (in: hKey=0x35d708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0293.263] WriteFile (in: hFile=0x678, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0293.264] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0293.264] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0293.264] WriteFile (in: hFile=0x678, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0293.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x562c020 | out: hHeap=0x310000) returned 1 [0293.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0293.269] CloseHandle (hObject=0x678) returned 1 [0293.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0293.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5e10 [0293.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5860 [0293.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4d88 [0293.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5e10 | out: hHeap=0x310000) returned 1 [0293.269] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0293.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a58f8 [0293.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb9b8 [0293.270] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0293.270] GetLastError () returned 0x0 [0293.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0293.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x2c6f520, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0293.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0293.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x515d828 [0293.271] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0293.272] WriteFile (in: hFile=0x678, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2c6f65c*=0xe59, lpOverlapped=0x0) returned 1 [0293.273] CloseHandle (hObject=0x678) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x515d828 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb9b8 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4d88 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5860 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0293.273] CryptDestroyKey (hKey=0x35d708) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5698 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306ad8 | out: hHeap=0x310000) returned 1 [0293.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a2b8 | out: hHeap=0x310000) returned 1 [0293.273] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0293.273] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0293.273] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.273] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0293.545] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.545] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0293.545] CloseHandle (hObject=0x678) returned 1 [0293.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a58f8 [0293.545] RmStartSession () returned 0x0 [0293.864] RmRegisterResources () returned 0x0 [0293.865] RmGetList () returned 0x0 [0295.486] RmShutdown () returned 0x0 [0297.214] RmEndSession () returned 0x0 [0297.215] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2c6f7e8 | out: phKey=0x2c6f7e8*=0x5261a08) returned 1 [0297.215] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0297.215] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF", dwFileAttributes=0x220) returned 1 [0297.215] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0297.215] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2c6f648*=0x2000) returned 1 [0297.215] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2c6f6e0 | out: lpFileSize=0x2c6f6e0*=6996) returned 1 [0297.215] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0297.215] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf6020 [0297.374] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0297.374] ReadFile (in: hFile=0x55c, lpBuffer=0x4cf6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2c6f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4cf6040*, lpNumberOfBytesRead=0x2c6f6e8*=0x1b54, lpOverlapped=0x0) returned 1 [0297.375] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d0 | out: lpNewFilePointer=0x0) returned 1 [0297.375] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2c6f65c*=0x2000) returned 1 [0297.375] WriteFile (in: hFile=0x55c, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2c6f6ec*=0x2000, lpOverlapped=0x0) returned 1 [0297.376] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6f6d8 | out: lpNewFilePointer=0x0) returned 1 [0297.376] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2c6f6ec*=0x200, lpOverlapped=0x0) returned 1 [0297.376] WriteFile (in: hFile=0x55c, lpBuffer=0x2c6f688*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x2c6f688*, lpNumberOfBytesWritten=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0297.376] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf6020 | out: hHeap=0x310000) returned 1 [0297.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0297.403] CloseHandle (hObject=0x55c) returned 1 [0297.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0297.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6070be0 [0297.403] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95348 [0297.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6070c98 [0297.404] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6070be0 | out: hHeap=0x310000) returned 1 [0297.404] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c956d8 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0297.405] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2c6f4bc | out: lpSystemTimeAsFileTime=0x2c6f4bc) [0297.405] GetLastError () returned 0x0 [0297.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VczdUZcTKKQEDrj6wrc", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0297.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VczdUZcTKKQEDrj6wrc", cchWideChar=19, lpMultiByteStr=0x38c3e0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VczdUZcTKKQEDrj6wrc", lpUsedDefaultChar=0x0) returned 19 [0297.405] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b538 | out: hHeap=0x310000) returned 1 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0297.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0297.405] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0297.406] WriteFile (in: hFile=0x55c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2c6f65c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2c6f65c*=0xe66, lpOverlapped=0x0) returned 1 [0297.407] CloseHandle (hObject=0x55c) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c956d8 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6070c98 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95348 | out: hHeap=0x310000) returned 1 [0297.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0297.407] CryptDestroyKey (hKey=0x5261a08) returned 1 [0297.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0297.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53063b8 | out: hHeap=0x310000) returned 1 [0297.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609d18 | out: hHeap=0x310000) returned 1 [0297.408] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2c6f81c, lpCompletionKey=0x2c6f820, lpOverlapped=0x2c6f818) returned 1 [0297.408] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0297.408] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f0 | out: lpNewFilePointer=0xffffffff) returned 1 [0297.408] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6ec, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6ec*=0x18, lpOverlapped=0x0) returned 1 [0297.426] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6f6f8 | out: lpNewFilePointer=0xffffffff) returned 1 [0297.426] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2c6f6e0, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2c6f6e0*=0x18, lpOverlapped=0x0) returned 1 [0297.426] CloseHandle (hObject=0x55c) returned 1 [0297.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95348 [0297.426] RmStartSession () returned 0x0 [0297.430] RmRegisterResources () returned 0x0 [0297.434] RmGetList () returned 0x0 [0298.583] RmShutdown () Thread: id = 4 os_tid = 0x13f8 [0068.581] GetLastError () returned 0x57 [0068.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x345f80 [0068.582] SetLastError (dwErrCode=0x57) [0068.582] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0070.882] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0086.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0093.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0097.963] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0098.982] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0102.166] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0103.173] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0104.164] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0108.723] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0127.651] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0128.656] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0129.664] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0130.687] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0131.701] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0132.740] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 0 [0133.782] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0134.187] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0134.191] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.191] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0134.193] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.193] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0134.193] CloseHandle (hObject=0x4e4) returned 1 [0134.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0134.193] RmStartSession () returned 0x0 [0134.447] RmRegisterResources () returned 0x0 [0134.544] RmGetList () returned 0x0 [0135.234] RmShutdown () returned 0x0 [0137.622] RmEndSession () returned 0x0 [0137.766] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261548) returned 1 [0137.766] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0137.767] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", dwFileAttributes=0x20) returned 1 [0137.767] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0137.767] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0137.767] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=577) returned 1 [0137.767] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0137.767] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dc5020 [0137.786] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0137.786] ReadFile (in: hFile=0x528, lpBuffer=0x4dc5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x4dc5040*, lpNumberOfBytesRead=0x2dafa58*=0x241, lpOverlapped=0x0) returned 1 [0137.833] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0137.833] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0137.833] WriteFile (in: hFile=0x528, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0137.833] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0137.833] WriteFile (in: hFile=0x528, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0137.834] WriteFile (in: hFile=0x528, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0137.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dc5020 | out: hHeap=0x310000) returned 1 [0137.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0137.839] CloseHandle (hObject=0x528) returned 1 [0138.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0138.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0138.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50607d0 [0138.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0138.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0138.036] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.bdcddcbaad"), dwFlags=0x1) returned 1 [0138.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b8f0 [0138.037] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.037] GetLastError () returned 0x0 [0138.037] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] GetLastError () returned 0x0 [0138.038] SetLastError (dwErrCode=0x0) [0138.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0138.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x2daf890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sZcY8NRWe7TT", lpUsedDefaultChar=0x0) returned 12 [0138.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0138.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5061058 [0138.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060e50 [0138.424] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\safeos\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0138.425] WriteFile (in: hFile=0x66c, lpBuffer=0x5061058*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x5061058*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5f, lpOverlapped=0x0) returned 1 [0138.426] CloseHandle (hObject=0x66c) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060e50 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5061058 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8f0 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50607d0 | out: hHeap=0x310000) returned 1 [0138.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0138.426] CryptDestroyKey (hKey=0x5261548) returned 1 [0138.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0138.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0138.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365688 | out: hHeap=0x310000) returned 1 [0138.427] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0138.427] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0138.427] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.427] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0138.432] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.432] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0138.432] CloseHandle (hObject=0x66c) returned 1 [0138.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.432] RmStartSession () returned 0x0 [0138.436] RmRegisterResources () returned 0x0 [0138.439] RmGetList () returned 0x0 [0138.870] RmShutdown () returned 0x0 [0140.949] RmEndSession () returned 0x0 [0140.950] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x35d6c8) returned 1 [0140.950] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0140.950] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x80) returned 1 [0140.950] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0140.950] CryptEncrypt (in: hKey=0x35d6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0140.950] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=3188) returned 1 [0140.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0140.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6846020 [0141.247] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0141.247] ReadFile (in: hFile=0x66c, lpBuffer=0x6846040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6846040*, lpNumberOfBytesRead=0x2dafa58*=0xc74, lpOverlapped=0x0) returned 1 [0141.248] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0141.249] CryptEncrypt (in: hKey=0x35d6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0141.249] WriteFile (in: hFile=0x66c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0141.249] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0141.249] WriteFile (in: hFile=0x66c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0141.249] WriteFile (in: hFile=0x66c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0141.250] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6846020 | out: hHeap=0x310000) returned 1 [0141.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0141.469] CloseHandle (hObject=0x66c) returned 1 [0141.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0141.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0141.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0141.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0141.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0141.471] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1033\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0141.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0141.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c78 [0141.500] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0141.500] GetLastError () returned 0x0 [0141.500] SetLastError (dwErrCode=0x0) [0141.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.500] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.501] SetLastError (dwErrCode=0x0) [0141.501] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0141.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] GetLastError () returned 0x0 [0141.502] SetLastError (dwErrCode=0x0) [0141.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0141.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0141.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x38c160, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RvQ78znxAxbgIhBd7BJgQH", lpUsedDefaultChar=0x0) returned 22 [0141.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0141.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0141.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5c96138 [0141.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac20 [0141.502] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0141.504] WriteFile (in: hFile=0x66c, lpBuffer=0x5c96138*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x5c96138*, lpNumberOfBytesWritten=0x2daf9cc*=0xe69, lpOverlapped=0x0) returned 1 [0141.505] CloseHandle (hObject=0x66c) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac20 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c96138 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c78 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0141.505] CryptDestroyKey (hKey=0x35d6c8) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0141.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18bb0 | out: hHeap=0x310000) returned 1 [0141.505] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0141.505] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0141.506] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.506] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0141.507] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.507] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0141.508] CloseHandle (hObject=0x66c) returned 1 [0141.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0141.508] RmStartSession () returned 0x0 [0141.510] RmRegisterResources () returned 0x0 [0141.514] RmGetList () returned 0x0 [0142.033] RmShutdown () returned 0x0 [0142.805] RmEndSession () returned 0x0 [0142.806] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261508) returned 1 [0142.806] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0142.806] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0142.806] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0142.807] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0142.807] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=82962) returned 1 [0142.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5df4048 [0142.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a6f020 [0142.936] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0142.936] ReadFile (in: hFile=0x66c, lpBuffer=0x6a6f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6a6f040*, lpNumberOfBytesRead=0x2dafa58*=0x14412, lpOverlapped=0x0) returned 1 [0142.954] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0142.954] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.954] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.954] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.955] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.955] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.955] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.955] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.955] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.955] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.955] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.955] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.955] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.956] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.956] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.956] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.956] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.956] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.956] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.956] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.956] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.956] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0142.956] WriteFile (in: hFile=0x66c, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0142.957] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0142.957] WriteFile (in: hFile=0x66c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0142.957] WriteFile (in: hFile=0x66c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0142.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a6f020 | out: hHeap=0x310000) returned 1 [0142.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5df4048 | out: hHeap=0x310000) returned 1 [0142.964] CloseHandle (hObject=0x66c) returned 1 [0142.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0142.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0142.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1e98 [0142.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0142.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0142.968] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1036\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0142.969] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2310 [0142.969] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0142.969] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.969] SetLastError (dwErrCode=0x0) [0142.969] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0142.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0142.970] GetLastError () returned 0x0 [0142.970] SetLastError (dwErrCode=0x0) [0142.970] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365868 [0142.971] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.971] GetLastError () returned 0x0 [0142.971] SetLastError (dwErrCode=0x0) [0142.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0142.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0142.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0142.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x38c098, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", lpUsedDefaultChar=0x0) returned 28 [0142.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0142.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0142.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0142.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39af68 [0142.972] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0142.978] WriteFile (in: hFile=0x66c, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6f, lpOverlapped=0x0) returned 1 [0143.493] CloseHandle (hObject=0x66c) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39af68 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2310 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0143.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0143.494] CryptDestroyKey (hKey=0x5261508) returned 1 [0144.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0144.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0144.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c50 | out: hHeap=0x310000) returned 1 [0144.253] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0144.253] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0144.254] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.254] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0144.299] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.299] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0144.299] CloseHandle (hObject=0x49c) returned 1 [0144.299] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0144.299] RmStartSession () returned 0x0 [0144.302] RmRegisterResources () returned 0x0 [0144.306] RmGetList () returned 0x0 [0148.330] RmShutdown () returned 0x0 [0149.019] RmEndSession () returned 0x0 [0149.020] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261408) returned 1 [0149.020] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0149.020] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x80) returned 1 [0149.020] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0149.020] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0149.020] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=3546) returned 1 [0149.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5305480 [0149.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5720020 [0149.284] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0149.284] ReadFile (in: hFile=0x49c, lpBuffer=0x5720040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x5720040*, lpNumberOfBytesRead=0x2dafa58*=0xdda, lpOverlapped=0x0) returned 1 [0149.286] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0149.286] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53054a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x53054a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0149.286] WriteFile (in: hFile=0x49c, lpBuffer=0x53054a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x53054a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0149.286] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0149.286] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0149.286] WriteFile (in: hFile=0x49c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0149.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5720020 | out: hHeap=0x310000) returned 1 [0150.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5305480 | out: hHeap=0x310000) returned 1 [0150.490] CloseHandle (hObject=0x49c) returned 1 [0150.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0150.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0150.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0150.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1bc0 [0150.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0150.492] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1043\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0150.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0150.492] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2d68 [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.493] GetLastError () returned 0x0 [0150.493] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0150.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetLastError () returned 0x0 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0150.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0150.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x38c1b0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9XOqcHODkUzIb3wxAPZ", lpUsedDefaultChar=0x0) returned 19 [0150.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0150.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0150.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0150.494] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39670 [0150.494] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0150.495] WriteFile (in: hFile=0x49c, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x2daf9cc*=0xe66, lpOverlapped=0x0) returned 1 [0150.496] CloseHandle (hObject=0x49c) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39670 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0150.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1bc0 | out: hHeap=0x310000) returned 1 [0150.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0150.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0150.497] CryptDestroyKey (hKey=0x5261408) returned 1 [0150.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0150.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399820 | out: hHeap=0x310000) returned 1 [0150.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19240 | out: hHeap=0x310000) returned 1 [0150.497] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0150.497] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0150.497] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.497] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0150.500] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.501] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0150.501] CloseHandle (hObject=0x49c) returned 1 [0150.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0150.501] RmStartSession () returned 0x0 [0150.503] RmRegisterResources () returned 0x0 [0150.507] RmGetList () returned 0x0 [0151.670] RmShutdown () returned 0x0 [0152.819] RmEndSession () returned 0x0 [0152.821] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261608) returned 1 [0152.821] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0152.821] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0152.821] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0152.821] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0152.821] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=39050) returned 1 [0152.821] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0152.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6833020 [0153.044] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0153.045] ReadFile (in: hFile=0x49c, lpBuffer=0x6833040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6833040*, lpNumberOfBytesRead=0x2dafa58*=0x988a, lpOverlapped=0x0) returned 1 [0153.062] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0153.062] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0153.063] WriteFile (in: hFile=0x49c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0153.063] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0153.063] WriteFile (in: hFile=0x49c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0153.063] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0153.063] WriteFile (in: hFile=0x49c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0153.063] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0153.063] WriteFile (in: hFile=0x49c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0153.063] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0153.064] WriteFile (in: hFile=0x49c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0153.064] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0153.064] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0153.064] WriteFile (in: hFile=0x49c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0153.064] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6833020 | out: hHeap=0x310000) returned 1 [0153.070] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0153.070] CloseHandle (hObject=0x49c) returned 1 [0153.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0153.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0153.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0153.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3effa0 [0153.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0153.073] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\Extended\\UiInfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0153.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0153.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398f88 [0153.075] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0153.075] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.076] SetLastError (dwErrCode=0x0) [0153.076] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0153.077] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5351c50 [0153.077] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0153.077] GetLastError () returned 0x0 [0153.077] SetLastError (dwErrCode=0x0) [0153.077] GetLastError () returned 0x0 [0153.078] SetLastError (dwErrCode=0x0) [0153.078] GetLastError () returned 0x0 [0153.078] SetLastError (dwErrCode=0x0) [0153.078] GetLastError () returned 0x0 [0153.078] SetLastError (dwErrCode=0x0) [0153.078] GetLastError () returned 0x0 [0153.078] SetLastError (dwErrCode=0x0) [0153.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0153.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0153.078] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0153.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x38c520, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", lpUsedDefaultChar=0x0) returned 29 [0153.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351c50 | out: hHeap=0x310000) returned 1 [0153.078] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0153.078] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x4ba9660 [0153.078] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0153.078] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0153.079] WriteFile (in: hFile=0x49c, lpBuffer=0x4ba9660*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4ba9660*, lpNumberOfBytesWritten=0x2daf9cc*=0xe70, lpOverlapped=0x0) returned 1 [0153.080] CloseHandle (hObject=0x49c) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9660 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398f88 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0153.081] CryptDestroyKey (hKey=0x5261608) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060080 | out: hHeap=0x310000) returned 1 [0153.081] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19740 | out: hHeap=0x310000) returned 1 [0153.081] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0153.081] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0153.081] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.081] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0153.486] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.486] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0153.486] CloseHandle (hObject=0x49c) returned 1 [0153.486] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0153.486] RmStartSession () returned 0x0 [0153.660] RmRegisterResources () returned 0x0 [0153.664] RmGetList () returned 0x0 [0153.915] RmShutdown () returned 0x0 [0157.055] RmEndSession () returned 0x0 [0157.579] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5260cc8) returned 1 [0157.579] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0157.579] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico", dwFileAttributes=0x80) returned 1 [0157.579] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0157.579] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0157.579] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=36710) returned 1 [0157.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bba5a8 [0157.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c4020 [0157.596] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0157.596] ReadFile (in: hFile=0x49c, lpBuffer=0x65c4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x65c4040*, lpNumberOfBytesRead=0x2dafa58*=0x8f66, lpOverlapped=0x0) returned 1 [0157.628] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0157.628] WriteFile (in: hFile=0x49c, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0157.628] WriteFile (in: hFile=0x49c, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0157.628] WriteFile (in: hFile=0x49c, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0157.628] WriteFile (in: hFile=0x49c, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0157.628] WriteFile (in: hFile=0x49c, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0157.629] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0157.629] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0157.629] WriteFile (in: hFile=0x49c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0157.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c4020 | out: hHeap=0x310000) returned 1 [0157.634] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba5a8 | out: hHeap=0x310000) returned 1 [0157.634] CloseHandle (hObject=0x49c) returned 1 [0157.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0157.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0157.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1bc0 [0157.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0157.635] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0157.636] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0157.636] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0157.636] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0157.636] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0157.636] GetLastError () returned 0x0 [0157.636] SetLastError (dwErrCode=0x0) [0157.636] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0157.636] GetLastError () returned 0x0 [0157.636] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] GetLastError () returned 0x0 [0157.637] SetLastError (dwErrCode=0x0) [0157.637] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0157.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0157.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x2daf890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eOdNRgPs7m", lpUsedDefaultChar=0x0) returned 10 [0157.637] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0157.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0157.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0157.637] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1bc0 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0157.638] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060d18 | out: hHeap=0x310000) returned 1 [0157.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5c60 | out: hHeap=0x310000) returned 1 [0157.638] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0157.638] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0157.638] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.638] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0157.684] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.685] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0157.685] CloseHandle (hObject=0x49c) returned 1 [0157.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0157.685] RmStartSession () returned 0x0 [0157.815] RmRegisterResources () returned 0x0 [0157.819] RmGetList () returned 0x0 [0159.468] RmShutdown () returned 0x0 [0161.439] RmEndSession () returned 0x0 [0162.245] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261008) returned 1 [0162.245] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0162.245] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi", dwFileAttributes=0x80) returned 1 [0162.246] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0162.246] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0162.246] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=184832) returned 1 [0162.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0162.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590c020 [0162.266] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0162.266] ReadFile (in: hFile=0x49c, lpBuffer=0x590c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x590c040*, lpNumberOfBytesRead=0x2dafa58*=0x2d200, lpOverlapped=0x0) returned 1 [0162.402] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0162.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.402] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.402] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.402] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.402] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.403] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.404] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.404] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0162.405] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0162.405] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0162.406] WriteFile (in: hFile=0x49c, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0162.406] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590c020 | out: hHeap=0x310000) returned 1 [0162.411] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0162.411] CloseHandle (hObject=0x49c) returned 1 [0162.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0162.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0162.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0162.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f02e8 [0162.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0162.414] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0162.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0162.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7d8 [0162.415] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.415] GetLastError () returned 0x0 [0162.415] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.416] SetLastError (dwErrCode=0x0) [0162.416] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0162.417] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5296378 [0162.417] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] GetLastError () returned 0x0 [0162.417] SetLastError (dwErrCode=0x0) [0162.417] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0162.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q1AfbAKuprW61B5MjEbcongvGb", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0162.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0162.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q1AfbAKuprW61B5MjEbcongvGb", cchWideChar=26, lpMultiByteStr=0x38c1d8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q1AfbAKuprW61B5MjEbcongvGb", lpUsedDefaultChar=0x0) returned 26 [0162.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5296378 | out: hHeap=0x310000) returned 1 [0162.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0162.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bad110 [0162.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0162.418] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0162.419] WriteFile (in: hFile=0x49c, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6d, lpOverlapped=0x0) returned 1 [0162.419] CloseHandle (hObject=0x49c) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f02e8 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0162.420] CryptDestroyKey (hKey=0x5261008) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398e80 | out: hHeap=0x310000) returned 1 [0162.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5850 | out: hHeap=0x310000) returned 1 [0162.420] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0162.420] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0162.420] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.420] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0162.709] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.709] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0162.709] CloseHandle (hObject=0x49c) returned 1 [0162.709] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0162.709] RmStartSession () returned 0x0 [0164.782] RmRegisterResources () returned 0x0 [0164.787] RmGetList () returned 0x0 [0166.656] RmShutdown () returned 0x0 [0170.673] RmEndSession () returned 0x0 [0170.776] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261508) returned 1 [0170.776] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0170.776] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0170.777] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0170.777] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0170.777] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0170.777] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5339060 [0170.777] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6ea2020 [0170.793] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0170.793] ReadFile (in: hFile=0x668, lpBuffer=0x6ea2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6ea2040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0170.804] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0170.804] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.804] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.815] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.815] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.816] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.816] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0170.816] WriteFile (in: hFile=0x668, lpBuffer=0x5339080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5339080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0170.816] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0170.816] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0170.816] WriteFile (in: hFile=0x668, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0170.816] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6ea2020 | out: hHeap=0x310000) returned 1 [0171.383] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5339060 | out: hHeap=0x310000) returned 1 [0171.582] CloseHandle (hObject=0x668) returned 1 [0171.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0171.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53215c0 [0171.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3e68 [0171.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321658 [0171.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53215c0 | out: hHeap=0x310000) returned 1 [0171.585] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0171.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0171.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0171.585] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0171.585] GetLastError () returned 0x0 [0171.585] SetLastError (dwErrCode=0x0) [0171.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4660 [0171.585] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.586] SetLastError (dwErrCode=0x0) [0171.586] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bab0 [0171.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] GetLastError () returned 0x0 [0171.587] SetLastError (dwErrCode=0x0) [0171.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0171.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bab0 | out: hHeap=0x310000) returned 1 [0171.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4660 | out: hHeap=0x310000) returned 1 [0171.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0171.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0171.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x38c3b8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eccP6SvgOOuCqWKgmyr9SIud", lpUsedDefaultChar=0x0) returned 24 [0171.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0171.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0171.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0171.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0171.588] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0171.589] WriteFile (in: hFile=0x668, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6b, lpOverlapped=0x0) returned 1 [0171.590] CloseHandle (hObject=0x668) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321658 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3e68 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0171.590] CryptDestroyKey (hKey=0x5261508) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365198 | out: hHeap=0x310000) returned 1 [0171.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365818 | out: hHeap=0x310000) returned 1 [0171.590] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0171.590] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0171.590] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.591] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0171.617] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.618] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0171.618] CloseHandle (hObject=0x668) returned 1 [0171.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bba990 [0171.618] RmStartSession () returned 0x0 [0171.621] RmRegisterResources () returned 0x0 [0171.625] RmGetList () returned 0x0 [0172.150] RmShutdown () returned 0x0 [0173.806] RmEndSession () returned 0x0 [0173.807] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261748) returned 1 [0173.807] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0173.807] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0173.807] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0173.807] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0173.807] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0173.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2088 [0173.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x70b7020 [0174.073] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0174.073] ReadFile (in: hFile=0x668, lpBuffer=0x70b7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x70b7040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0174.090] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0174.090] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.090] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.090] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.090] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.091] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0174.091] WriteFile (in: hFile=0x668, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0174.092] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0174.092] WriteFile (in: hFile=0x668, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0174.092] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x70b7020 | out: hHeap=0x310000) returned 1 [0174.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2088 | out: hHeap=0x310000) returned 1 [0174.097] CloseHandle (hObject=0x668) returned 1 [0174.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0174.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53355a8 [0174.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bba840 [0174.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5335888 [0174.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53355a8 | out: hHeap=0x310000) returned 1 [0174.100] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0174.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bbb170 [0174.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0174.101] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0174.101] GetLastError () returned 0x0 [0174.101] SetLastError (dwErrCode=0x0) [0174.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a44c8 [0174.101] GetLastError () returned 0x0 [0174.101] SetLastError (dwErrCode=0x0) [0174.101] GetLastError () returned 0x0 [0174.101] SetLastError (dwErrCode=0x0) [0174.101] GetLastError () returned 0x0 [0174.101] SetLastError (dwErrCode=0x0) [0174.101] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a44c8 | out: hHeap=0x310000) returned 1 [0174.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0174.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x2daf890, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dz", lpUsedDefaultChar=0x0) returned 2 [0174.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0174.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0174.101] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0174.102] WriteFile (in: hFile=0x668, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x2daf9cc*=0xe55, lpOverlapped=0x0) returned 1 [0174.103] CloseHandle (hObject=0x668) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbb170 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5335888 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba840 | out: hHeap=0x310000) returned 1 [0174.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0174.103] CryptDestroyKey (hKey=0x5261748) returned 1 [0174.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba990 | out: hHeap=0x310000) returned 1 [0174.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c931f8 | out: hHeap=0x310000) returned 1 [0174.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e63d0 | out: hHeap=0x310000) returned 1 [0174.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0174.104] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0174.104] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.104] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0174.124] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.124] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0174.124] CloseHandle (hObject=0x668) returned 1 [0174.124] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0174.124] RmStartSession () returned 0x0 [0174.127] RmRegisterResources () returned 0x0 [0174.132] RmGetList () returned 0x0 [0174.532] RmShutdown () returned 0x0 [0176.631] RmEndSession () returned 0x0 [0176.631] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261748) returned 1 [0176.631] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0176.632] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0176.632] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0176.632] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0176.632] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0176.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0176.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6661020 [0176.935] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0176.935] ReadFile (in: hFile=0x668, lpBuffer=0x6661040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6661040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0176.937] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0176.937] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.937] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.937] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.937] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.937] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.937] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.938] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0176.938] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0176.939] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0176.939] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0176.939] WriteFile (in: hFile=0x668, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0176.939] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6661020 | out: hHeap=0x310000) returned 1 [0177.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0177.001] CloseHandle (hObject=0x668) returned 1 [0177.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0177.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5339448 [0177.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0177.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53393a0 [0177.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5339448 | out: hHeap=0x310000) returned 1 [0177.003] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0177.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0177.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0177.004] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.004] GetLastError () returned 0x0 [0177.004] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] GetLastError () returned 0x0 [0177.005] SetLastError (dwErrCode=0x0) [0177.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0177.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x2daf890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mLGY6f92w4A", lpUsedDefaultChar=0x0) returned 11 [0177.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0177.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0177.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0177.005] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0177.006] WriteFile (in: hFile=0x668, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5e, lpOverlapped=0x0) returned 1 [0177.007] CloseHandle (hObject=0x668) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53393a0 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0177.007] CryptDestroyKey (hKey=0x5261748) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0177.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea2e0 | out: hHeap=0x310000) returned 1 [0177.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6560 | out: hHeap=0x310000) returned 1 [0177.008] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0177.008] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0177.008] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.008] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0177.056] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.056] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0177.056] CloseHandle (hObject=0x668) returned 1 [0177.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5323110 [0177.056] RmStartSession () returned 0x0 [0177.866] RmRegisterResources () returned 0x0 [0177.871] RmGetList () returned 0x0 [0179.282] RmShutdown () returned 0x0 [0181.696] RmEndSession () returned 0x0 [0181.969] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x52613c8) returned 1 [0181.969] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0181.969] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x20) returned 1 [0181.970] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0181.970] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0181.970] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0181.970] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd40c8 [0181.970] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5838020 [0181.989] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0181.990] ReadFile (in: hFile=0x584, lpBuffer=0x5838040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x5838040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0182.051] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0182.051] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.051] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.051] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.051] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.051] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.051] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.052] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0182.052] WriteFile (in: hFile=0x584, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0182.053] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0182.053] WriteFile (in: hFile=0x584, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0182.053] WriteFile (in: hFile=0x584, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0182.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5838020 | out: hHeap=0x310000) returned 1 [0182.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd40c8 | out: hHeap=0x310000) returned 1 [0183.307] CloseHandle (hObject=0x584) returned 1 [0183.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0183.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51ca1f0 [0183.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327c78 [0183.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9e00 [0183.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ca1f0 | out: hHeap=0x310000) returned 1 [0183.310] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0183.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327e40 [0183.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0183.311] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0183.311] GetLastError () returned 0x0 [0183.311] SetLastError (dwErrCode=0x0) [0183.311] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7a0 [0183.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.312] GetLastError () returned 0x0 [0183.312] SetLastError (dwErrCode=0x0) [0183.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab318 [0183.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] GetLastError () returned 0x0 [0183.313] SetLastError (dwErrCode=0x0) [0183.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0183.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0183.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0183.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x38c480, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", lpUsedDefaultChar=0x0) returned 31 [0183.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab318 | out: hHeap=0x310000) returned 1 [0183.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0183.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5409c80 [0183.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0183.313] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0183.314] WriteFile (in: hFile=0x584, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x2daf9cc*=0xe72, lpOverlapped=0x0) returned 1 [0183.315] CloseHandle (hObject=0x584) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327e40 | out: hHeap=0x310000) returned 1 [0183.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9e00 | out: hHeap=0x310000) returned 1 [0183.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327c78 | out: hHeap=0x310000) returned 1 [0183.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0183.316] CryptDestroyKey (hKey=0x52613c8) returned 1 [0183.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5323110 | out: hHeap=0x310000) returned 1 [0183.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c908 | out: hHeap=0x310000) returned 1 [0183.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e66a0 | out: hHeap=0x310000) returned 1 [0183.316] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0183.316] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0183.316] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.316] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0183.321] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.321] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0183.321] CloseHandle (hObject=0x584) returned 1 [0183.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0183.321] RmStartSession () returned 0x0 [0183.324] RmRegisterResources () returned 0x0 [0183.328] RmGetList () returned 0x0 [0185.842] RmShutdown () returned 0x0 [0187.596] RmEndSession () returned 0x0 [0187.597] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261988) returned 1 [0187.597] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0187.597] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0187.598] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0187.598] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0187.598] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0187.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd4078 [0187.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6778020 [0187.616] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0187.616] ReadFile (in: hFile=0x584, lpBuffer=0x6778040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6778040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0187.786] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0187.786] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.786] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.786] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.786] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.786] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.786] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.786] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.786] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.786] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.786] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.787] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.787] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.787] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.787] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0187.787] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0187.787] WriteFile (in: hFile=0x584, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0187.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6778020 | out: hHeap=0x310000) returned 1 [0188.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd4078 | out: hHeap=0x310000) returned 1 [0188.280] CloseHandle (hObject=0x584) returned 1 [0188.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0188.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0188.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0188.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0188.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0188.283] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0188.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0188.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0188.283] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0188.283] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.284] SetLastError (dwErrCode=0x0) [0188.284] GetLastError () returned 0x0 [0188.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ghQUkMJPBpzr5nf", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0188.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ghQUkMJPBpzr5nf", cchWideChar=15, lpMultiByteStr=0x2daf890, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghQUkMJPBpzr5nf", lpUsedDefaultChar=0x0) returned 15 [0188.285] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0188.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540c818 [0188.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5410238 [0188.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c30 [0188.285] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0188.286] WriteFile (in: hFile=0x584, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x2daf9cc*=0xe62, lpOverlapped=0x0) returned 1 [0188.286] CloseHandle (hObject=0x584) returned 1 [0188.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0188.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540c818 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0188.288] CryptDestroyKey (hKey=0x5261988) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ee8 | out: hHeap=0x310000) returned 1 [0188.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6ab0 | out: hHeap=0x310000) returned 1 [0188.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0188.288] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0188.288] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.288] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0188.336] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.336] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0188.336] CloseHandle (hObject=0x584) returned 1 [0188.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0360 [0188.336] RmStartSession () returned 0x0 [0188.338] RmRegisterResources () returned 0x0 [0188.339] RmGetList () returned 0x0 [0190.679] RmShutdown () returned 0x0 [0191.038] RmEndSession () returned 0x0 [0191.210] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x35dc88) returned 1 [0191.210] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0191.210] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0191.211] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0191.211] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0191.211] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0191.211] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0191.211] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6729020 [0191.229] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0191.229] ReadFile (in: hFile=0x584, lpBuffer=0x6729040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6729040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0191.232] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0191.232] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.232] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.232] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.233] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0191.233] WriteFile (in: hFile=0x584, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0191.234] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0191.234] WriteFile (in: hFile=0x584, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0191.234] WriteFile (in: hFile=0x584, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0191.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6729020 | out: hHeap=0x310000) returned 1 [0191.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0191.239] CloseHandle (hObject=0x584) returned 1 [0191.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0191.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0191.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0191.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0191.242] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0191.242] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0191.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3effa0 [0191.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0191.242] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0191.242] GetLastError () returned 0x0 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0191.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0191.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c188, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0191.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad3e8 | out: hHeap=0x310000) returned 1 [0191.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0191.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540e528 [0191.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c30 [0191.243] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0191.244] WriteFile (in: hFile=0x584, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6c, lpOverlapped=0x0) returned 1 [0191.246] CloseHandle (hObject=0x584) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0191.246] CryptDestroyKey (hKey=0x35dc88) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ab0 | out: hHeap=0x310000) returned 1 [0191.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c190b0 | out: hHeap=0x310000) returned 1 [0191.246] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0191.246] CreateFileW (lpFileName="C:\\\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0191.247] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.247] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0191.438] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.438] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0191.438] CloseHandle (hObject=0x584) returned 1 [0191.438] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0191.438] RmStartSession () returned 0x0 [0191.973] RmRegisterResources () returned 0x0 [0191.977] RmGetList () returned 0x0 [0194.469] RmShutdown () returned 0x0 [0197.909] RmEndSession () returned 0x0 [0197.910] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261ac8) returned 1 [0197.910] GetFileAttributesW (lpFileName="C:\\\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0197.910] SetFileAttributesW (lpFileName="C:\\\\Logs\\Setup.evtx", dwFileAttributes=0x20) returned 1 [0197.910] CreateFileW (lpFileName="C:\\\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0197.910] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0197.910] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=69632) returned 1 [0197.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5421cc0 [0197.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5895020 [0198.410] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0198.410] ReadFile (in: hFile=0x584, lpBuffer=0x5895040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x5895040*, lpNumberOfBytesRead=0x2dafa58*=0x11000, lpOverlapped=0x0) returned 1 [0198.412] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0198.412] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.412] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.412] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.413] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.413] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.413] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.413] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.413] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.413] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.413] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.413] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.413] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.413] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.414] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.414] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.414] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.414] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0198.414] WriteFile (in: hFile=0x584, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0198.414] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0198.414] WriteFile (in: hFile=0x584, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0198.414] WriteFile (in: hFile=0x584, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0198.415] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5895020 | out: hHeap=0x310000) returned 1 [0198.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5421cc0 | out: hHeap=0x310000) returned 1 [0198.685] CloseHandle (hObject=0x584) returned 1 [0198.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0198.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0198.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0198.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0198.686] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0198.686] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="C:\\\\Logs\\Setup.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\setup.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b810 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0198.687] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0198.687] GetLastError () returned 0x0 [0198.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0198.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x38c3e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lRTaZqgzay52GZY8", lpUsedDefaultChar=0x0) returned 16 [0198.687] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0198.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c30 [0198.687] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0198.688] WriteFile (in: hFile=0x584, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe63, lpOverlapped=0x0) returned 1 [0198.690] CloseHandle (hObject=0x584) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b810 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0198.690] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0198.690] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b448f8 | out: hHeap=0x310000) returned 1 [0198.690] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0198.690] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0198.691] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.691] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0198.693] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.693] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0198.694] CloseHandle (hObject=0x584) returned 1 [0198.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7ffa0 [0198.694] RmStartSession () returned 0x0 [0198.698] RmRegisterResources () returned 0x0 [0198.704] RmGetList () returned 0x0 [0200.620] RmShutdown () returned 0x0 [0204.725] RmEndSession () returned 0x0 [0204.784] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261648) returned 1 [0204.784] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0204.785] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui", dwFileAttributes=0x20) returned 0 [0204.785] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.785] CryptDestroyKey (hKey=0x5261648) returned 1 [0204.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7ffa0 | out: hHeap=0x310000) returned 1 [0204.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3908e8 | out: hHeap=0x310000) returned 1 [0204.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c080a0 | out: hHeap=0x310000) returned 1 [0204.785] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0204.785] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0204.874] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.874] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0204.878] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.878] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0204.878] CloseHandle (hObject=0x574) returned 1 [0204.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ec8a8 [0204.878] RmStartSession () returned 0x0 [0204.882] RmRegisterResources () returned 0x0 [0204.885] RmGetList () returned 0x0 [0205.186] RmShutdown () returned 0x0 [0205.751] RmEndSession () returned 0x0 [0205.752] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261788) returned 1 [0205.752] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0205.752] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", dwFileAttributes=0x20) returned 0 [0205.752] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.752] CryptDestroyKey (hKey=0x5261788) returned 1 [0205.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ec8a8 | out: hHeap=0x310000) returned 1 [0205.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3913b0 | out: hHeap=0x310000) returned 1 [0205.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08820 | out: hHeap=0x310000) returned 1 [0205.752] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0205.752] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0205.753] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.753] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0205.754] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.754] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0205.754] CloseHandle (hObject=0x574) returned 1 [0205.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ec8a8 [0205.754] RmStartSession () returned 0x0 [0205.757] RmRegisterResources () returned 0x0 [0205.761] RmGetList () returned 0x0 [0206.991] RmShutdown () returned 0x0 [0208.315] RmEndSession () returned 0x0 [0208.908] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261948) returned 1 [0208.908] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0208.909] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", dwFileAttributes=0x20) returned 0 [0208.909] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.909] CryptDestroyKey (hKey=0x5261948) returned 1 [0208.909] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ec8a8 | out: hHeap=0x310000) returned 1 [0208.909] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc0a0 | out: hHeap=0x310000) returned 1 [0208.909] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c085f0 | out: hHeap=0x310000) returned 1 [0208.909] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0208.909] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0208.909] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.909] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0208.916] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.916] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0208.916] CloseHandle (hObject=0x574) returned 1 [0208.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ec8a8 [0208.916] RmStartSession () returned 0x0 [0208.933] RmRegisterResources () returned 0x0 [0208.938] RmGetList () returned 0x0 [0209.531] RmShutdown () returned 0x0 [0212.025] RmEndSession () returned 0x0 [0212.026] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x35db88) returned 1 [0212.026] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0212.026] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", dwFileAttributes=0x20) returned 0 [0212.026] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.027] CryptDestroyKey (hKey=0x35db88) returned 1 [0212.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ec8a8 | out: hHeap=0x310000) returned 1 [0212.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc7d0 | out: hHeap=0x310000) returned 1 [0212.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a53d0 | out: hHeap=0x310000) returned 1 [0212.027] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0212.027] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0212.027] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.027] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0212.055] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.055] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0212.055] CloseHandle (hObject=0x574) returned 1 [0212.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93a80 [0212.055] RmStartSession () returned 0x0 [0212.056] RmRegisterResources () returned 0x0 [0212.057] RmGetList () returned 0x0 [0212.449] RmShutdown () returned 0x0 [0214.116] RmEndSession () returned 0x0 [0214.117] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261688) returned 1 [0214.117] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0214.117] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml", dwFileAttributes=0x20) returned 0 [0214.117] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.117] CryptDestroyKey (hKey=0x5261688) returned 1 [0214.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93a80 | out: hHeap=0x310000) returned 1 [0214.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93540 | out: hHeap=0x310000) returned 1 [0214.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5330 | out: hHeap=0x310000) returned 1 [0214.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0214.117] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0214.117] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.118] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0214.213] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.213] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0214.213] CloseHandle (hObject=0x574) returned 1 [0214.214] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc7f0 [0214.214] RmStartSession () returned 0x0 [0214.216] RmRegisterResources () returned 0x0 [0214.219] RmGetList () returned 0x0 [0215.476] RmShutdown () returned 0x0 [0217.391] RmEndSession () returned 0x0 [0217.392] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261a88) returned 1 [0217.392] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0217.392] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml", dwFileAttributes=0x20) returned 0 [0217.392] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.393] CryptDestroyKey (hKey=0x5261a88) returned 1 [0217.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc7f0 | out: hHeap=0x310000) returned 1 [0217.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebbd8 | out: hHeap=0x310000) returned 1 [0217.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5bf0 | out: hHeap=0x310000) returned 1 [0217.393] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0217.393] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0217.397] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.397] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0217.402] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.402] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0217.402] CloseHandle (hObject=0x574) returned 1 [0217.402] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc7f0 [0217.403] RmStartSession () returned 0x0 [0217.405] RmRegisterResources () returned 0x0 [0217.409] RmGetList () returned 0x0 [0217.756] RmShutdown () returned 0x0 [0218.751] RmEndSession () returned 0x0 [0218.752] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261a88) returned 1 [0218.752] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0218.752] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml", dwFileAttributes=0x20) returned 0 [0218.753] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.753] CryptDestroyKey (hKey=0x5261a88) returned 1 [0218.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc7f0 | out: hHeap=0x310000) returned 1 [0218.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb3e0 | out: hHeap=0x310000) returned 1 [0218.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5d80 | out: hHeap=0x310000) returned 1 [0218.753] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0218.753] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0218.753] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.753] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0218.756] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.756] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0218.756] CloseHandle (hObject=0x574) returned 1 [0218.756] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc7f0 [0218.757] RmStartSession () returned 0x0 [0218.759] RmRegisterResources () returned 0x0 [0218.760] RmGetList () returned 0x0 [0219.638] RmShutdown () returned 0x0 [0222.535] RmEndSession () returned 0x0 [0222.536] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261588) returned 1 [0222.536] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0222.536] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml", dwFileAttributes=0x20) returned 0 [0222.536] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.536] CryptDestroyKey (hKey=0x5261588) returned 1 [0222.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc7f0 | out: hHeap=0x310000) returned 1 [0222.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb248 | out: hHeap=0x310000) returned 1 [0222.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14330 | out: hHeap=0x310000) returned 1 [0222.536] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0222.537] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0222.537] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.537] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0222.569] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.569] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0222.569] CloseHandle (hObject=0x574) returned 1 [0222.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0222.569] RmStartSession () returned 0x0 [0222.571] RmRegisterResources () returned 0x0 [0222.571] RmGetList () returned 0x0 [0223.843] RmShutdown () returned 0x0 [0224.509] RmEndSession () returned 0x0 [0224.583] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261a88) returned 1 [0224.583] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0224.584] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0224.584] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.584] CryptDestroyKey (hKey=0x5261a88) returned 1 [0224.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0224.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee150 | out: hHeap=0x310000) returned 1 [0224.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c146a0 | out: hHeap=0x310000) returned 1 [0224.584] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0224.584] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0224.584] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.584] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0224.627] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.627] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0224.627] CloseHandle (hObject=0x610) returned 1 [0224.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3ee3f0 [0224.628] RmStartSession () returned 0x0 [0224.629] RmRegisterResources () returned 0x0 [0224.629] RmGetList () returned 0x0 [0224.801] RmShutdown () returned 0x0 [0226.123] RmEndSession () returned 0x0 [0226.124] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x52617c8) returned 1 [0226.124] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0226.124] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0226.124] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.124] CryptDestroyKey (hKey=0x52617c8) returned 1 [0226.124] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee3f0 | out: hHeap=0x310000) returned 1 [0226.124] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eedc8 | out: hHeap=0x310000) returned 1 [0226.124] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c146f0 | out: hHeap=0x310000) returned 1 [0226.124] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0226.124] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0226.125] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.125] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0226.126] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.126] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0226.126] CloseHandle (hObject=0x610) returned 1 [0226.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0226.126] RmStartSession () returned 0x0 [0226.128] RmRegisterResources () returned 0x0 [0226.132] RmGetList () returned 0x0 [0230.502] RmShutdown () returned 0x0 [0231.399] RmEndSession () returned 0x0 [0231.819] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x52616c8) returned 1 [0231.819] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0231.819] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", dwFileAttributes=0x20) returned 0 [0231.819] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.819] CryptDestroyKey (hKey=0x52616c8) returned 1 [0231.819] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0231.819] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee540 | out: hHeap=0x310000) returned 1 [0231.819] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14e20 | out: hHeap=0x310000) returned 1 [0231.819] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0231.819] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0231.820] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.820] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0231.838] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.838] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0231.838] CloseHandle (hObject=0x610) returned 1 [0231.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ee8 [0231.838] RmStartSession () returned 0x0 [0231.839] RmRegisterResources () returned 0x0 [0231.840] RmGetList () returned 0x0 [0234.384] RmShutdown () returned 0x0 [0234.712] RmEndSession () returned 0x0 [0234.712] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261148) returned 1 [0234.713] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0234.713] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msador28.tlb", dwFileAttributes=0x20) returned 0 [0234.713] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.713] CryptDestroyKey (hKey=0x5261148) returned 1 [0234.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ee8 | out: hHeap=0x310000) returned 1 [0234.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0234.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c196f0 | out: hHeap=0x310000) returned 1 [0234.713] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0234.713] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0234.713] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.713] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0234.714] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.714] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0234.714] CloseHandle (hObject=0x610) returned 1 [0234.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0234.715] RmStartSession () returned 0x0 [0234.716] RmRegisterResources () returned 0x0 [0234.716] RmGetList () returned 0x0 [0235.043] RmShutdown () returned 0x0 [0235.536] RmEndSession () returned 0x0 [0235.537] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5260cc8) returned 1 [0235.537] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0235.537] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", dwFileAttributes=0x20) returned 1 [0235.537] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0235.537] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0235.537] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=452) returned 1 [0235.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x68620a0 [0235.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b7020 [0235.556] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0235.556] ReadFile (in: hFile=0x610, lpBuffer=0x64b7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x64b7040*, lpNumberOfBytesRead=0x2dafa58*=0x1c4, lpOverlapped=0x0) returned 1 [0235.557] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0235.557] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68620c0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x68620c0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0235.557] WriteFile (in: hFile=0x610, lpBuffer=0x68620c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x68620c0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0235.559] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0235.559] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0235.560] WriteFile (in: hFile=0x610, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0235.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b7020 | out: hHeap=0x310000) returned 1 [0235.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x68620a0 | out: hHeap=0x310000) returned 1 [0235.565] CloseHandle (hObject=0x610) returned 1 [0235.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0235.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0235.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19f60 [0235.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0235.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0235.565] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.bdCDdCBaAd" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.bdcddcbaad"), dwFlags=0x1) returned 1 [0235.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0235.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0235.566] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0235.566] GetLastError () returned 0x0 [0235.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wzuNsDJsC", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0235.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wzuNsDJsC", cchWideChar=9, lpMultiByteStr=0x2daf890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wzuNsDJsC", lpUsedDefaultChar=0x0) returned 9 [0235.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0235.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0235.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0235.566] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\internet explorer\\signup\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0235.566] WriteFile (in: hFile=0x610, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5c, lpOverlapped=0x0) returned 1 [0235.567] CloseHandle (hObject=0x610) returned 1 [0235.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0235.568] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0235.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572108 | out: hHeap=0x310000) returned 1 [0235.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0235.568] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0235.568] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.568] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0235.569] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.569] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0235.569] CloseHandle (hObject=0x610) returned 1 [0235.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0235.569] RmStartSession () returned 0x0 [0235.997] RmRegisterResources () returned 0x0 [0235.997] RmGetList () returned 0x0 [0236.036] RmShutdown () returned 0x0 [0237.847] RmEndSession () returned 0x0 [0238.492] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x52611c8) returned 1 [0238.492] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0238.493] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg", dwFileAttributes=0x20) returned 1 [0238.493] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0238.493] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0238.493] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=634) returned 1 [0238.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b60ff0 [0238.493] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6211020 [0238.512] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0238.512] ReadFile (in: hFile=0x610, lpBuffer=0x6211040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6211040*, lpNumberOfBytesRead=0x2dafa58*=0x27a, lpOverlapped=0x0) returned 1 [0238.513] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0238.513] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0238.513] WriteFile (in: hFile=0x610, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0238.548] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0238.548] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0238.548] WriteFile (in: hFile=0x610, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0238.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6211020 | out: hHeap=0x310000) returned 1 [0238.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b60ff0 | out: hHeap=0x310000) returned 1 [0238.553] CloseHandle (hObject=0x610) returned 1 [0238.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0238.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0238.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0238.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0238.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0238.553] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a230 [0238.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f88 [0238.554] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0238.554] GetLastError () returned 0x0 [0238.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VMExNofJE4VFz9a2IHu", lpUsedDefaultChar=0x0) returned 19 [0238.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0238.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0238.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0238.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0238.554] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0238.554] WriteFile (in: hFile=0x610, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe66, lpOverlapped=0x0) returned 1 [0238.555] CloseHandle (hObject=0x610) returned 1 [0238.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0238.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0238.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0238.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f88 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0238.556] CryptDestroyKey (hKey=0x52611c8) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a228 | out: hHeap=0x310000) returned 1 [0238.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572018 | out: hHeap=0x310000) returned 1 [0238.556] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0238.556] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0238.556] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.556] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0238.588] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.588] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0238.588] CloseHandle (hObject=0x610) returned 1 [0238.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0238.588] RmStartSession () returned 0x0 [0238.590] RmRegisterResources () returned 0x0 [0238.590] RmGetList () returned 0x0 [0240.581] RmShutdown () returned 0x0 [0244.720] RmEndSession () returned 0x0 [0244.721] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x52610c8) returned 1 [0244.721] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0244.721] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties", dwFileAttributes=0x20) returned 1 [0244.722] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0244.722] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0244.722] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=3409) returned 1 [0244.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0244.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621a020 [0245.391] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0245.392] GetLastError () returned 0x0 [0245.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0245.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x2daf890, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0245.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0245.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0245.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0245.392] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0245.392] WriteFile (in: hFile=0x610, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5c, lpOverlapped=0x0) returned 1 [0245.393] CloseHandle (hObject=0x610) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0245.393] CryptDestroyKey (hKey=0x52610c8) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55710e8 | out: hHeap=0x310000) returned 1 [0245.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572518 | out: hHeap=0x310000) returned 1 [0245.393] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0245.393] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0245.394] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.394] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0245.396] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.396] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0245.396] CloseHandle (hObject=0x610) returned 1 [0245.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0245.396] RmStartSession () returned 0x0 [0245.397] RmRegisterResources () returned 0x0 [0245.398] RmGetList () returned 0x0 [0245.426] RmShutdown () returned 0x0 [0246.074] RmEndSession () returned 0x0 [0246.075] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5260e48) returned 1 [0246.075] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0246.075] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf", dwFileAttributes=0x20) returned 1 [0246.075] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0246.075] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0246.075] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=344908) returned 1 [0246.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0246.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f4020 [0247.655] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0247.655] GetLastError () returned 0x0 [0247.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0247.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0247.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0247.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0247.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0247.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0247.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0247.655] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0247.656] WriteFile (in: hFile=0x610, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2daf9cc*=0xe63, lpOverlapped=0x0) returned 1 [0247.657] CloseHandle (hObject=0x610) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392058 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dce48 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0247.657] CryptDestroyKey (hKey=0x5260e48) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571050 | out: hHeap=0x310000) returned 1 [0247.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352ab0 | out: hHeap=0x310000) returned 1 [0247.657] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0247.658] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0247.658] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.658] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0247.659] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.659] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0247.659] CloseHandle (hObject=0x610) returned 1 [0247.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc158 [0247.659] RmStartSession () returned 0x0 [0247.660] RmRegisterResources () returned 0x0 [0247.664] RmGetList () [0250.481] RmShutdown () returned 0x0 [0251.741] RmEndSession () returned 0x0 [0251.742] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5260e08) returned 1 [0251.742] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0251.742] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0251.742] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0251.742] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0251.742] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=153) returned 1 [0251.742] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0251.743] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cc020 [0251.761] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0251.761] ReadFile (in: hFile=0x610, lpBuffer=0x65cc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x65cc040*, lpNumberOfBytesRead=0x2dafa58*=0x99, lpOverlapped=0x0) returned 1 [0251.762] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0251.762] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0251.762] WriteFile (in: hFile=0x610, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0251.768] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0251.769] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0251.769] WriteFile (in: hFile=0x610, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0251.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65cc020 | out: hHeap=0x310000) returned 1 [0251.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d6a020 | out: hHeap=0x310000) returned 1 [0251.774] CloseHandle (hObject=0x610) returned 1 [0251.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0251.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f9f78 [0251.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbb98 [0251.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53fa040 [0251.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9f78 | out: hHeap=0x310000) returned 1 [0251.774] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcf00 [0251.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a320 [0251.775] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0251.775] GetLastError () returned 0x0 [0251.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0251.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x2daf890, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y", lpUsedDefaultChar=0x0) returned 1 [0251.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0251.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0251.775] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0251.776] WriteFile (in: hFile=0x610, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x2daf9cc*=0xe54, lpOverlapped=0x0) returned 1 [0251.777] CloseHandle (hObject=0x610) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53fa040 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0251.777] CryptDestroyKey (hKey=0x5260e08) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc158 | out: hHeap=0x310000) returned 1 [0251.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dba28 | out: hHeap=0x310000) returned 1 [0251.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353280 | out: hHeap=0x310000) returned 1 [0251.778] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0251.778] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0251.778] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.778] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0252.053] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.053] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0252.053] CloseHandle (hObject=0x610) returned 1 [0252.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19600 [0252.053] RmStartSession () returned 0x0 [0252.158] RmRegisterResources () returned 0x0 [0252.159] RmGetList () returned 0x0 [0252.339] RmShutdown () returned 0x0 [0255.496] RmEndSession () returned 0x0 [0255.497] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261648) returned 1 [0255.497] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0255.497] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", dwFileAttributes=0x20) returned 1 [0255.497] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0255.497] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0255.497] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=3492573) returned 1 [0255.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0255.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56ff020 [0255.835] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0255.835] ReadFile (in: hFile=0x56c, lpBuffer=0x56ff040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x56ff040*, lpNumberOfBytesRead=0x2dafa58*=0x100000, lpOverlapped=0x0) returned 1 [0255.844] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0255.844] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.844] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.844] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.844] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.844] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.844] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.844] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.844] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.845] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.845] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.846] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.846] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.847] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.847] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.847] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.847] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.847] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.847] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.847] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.847] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.848] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.849] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.849] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.850] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.850] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.851] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.851] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.852] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.852] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.853] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.853] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.854] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.854] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.855] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.855] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.856] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.856] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.857] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.857] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.858] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.858] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.859] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.859] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.860] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.860] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.861] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.861] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.862] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.862] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.862] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.862] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.862] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.862] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.862] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0255.862] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0255.862] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0255.862] ReadFile (in: hFile=0x56c, lpBuffer=0x56ff040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x56ff040*, lpNumberOfBytesRead=0x2dafa58*=0x100000, lpOverlapped=0x0) returned 1 [0256.460] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0256.460] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.460] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.460] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.460] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.461] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.461] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.462] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.462] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.463] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.463] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.464] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.464] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.465] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.465] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.466] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.466] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.467] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.467] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.468] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.468] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.469] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.469] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.470] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.470] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.471] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.471] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.471] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.471] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.471] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.471] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.472] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.472] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.472] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.472] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.472] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.472] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.472] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.473] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.473] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.474] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.474] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.475] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.475] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.476] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.476] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.477] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.477] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0256.478] WriteFile (in: hFile=0x56c, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0256.992] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0256.992] GetLastError () returned 0x0 [0256.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0256.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c390, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0256.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b538 | out: hHeap=0x310000) returned 1 [0256.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0256.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0256.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0256.993] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0256.994] WriteFile (in: hFile=0x56c, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe64, lpOverlapped=0x0) returned 1 [0256.995] CloseHandle (hObject=0x56c) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0256.995] CryptDestroyKey (hKey=0x5261648) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19600 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c399b8 | out: hHeap=0x310000) returned 1 [0256.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352e70 | out: hHeap=0x310000) returned 1 [0256.995] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0256.995] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0256.995] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.995] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0257.003] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.004] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0257.004] CloseHandle (hObject=0x56c) returned 1 [0257.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19f60 [0257.004] RmStartSession () returned 0x0 [0257.004] RmRegisterResources () returned 0x0 [0257.005] RmGetList () returned 0x0 [0257.080] RmShutdown () returned 0x0 [0258.011] RmEndSession () returned 0x0 [0258.012] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261088) returned 1 [0258.012] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0258.012] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM", dwFileAttributes=0x20) returned 1 [0258.012] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0258.012] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0258.012] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=174528) returned 1 [0258.012] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b6b008 [0258.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b9020 [0258.793] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0258.793] GetLastError () returned 0x0 [0258.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TRxzM0DGsyQfi7UmuqCoF1I", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0258.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0258.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TRxzM0DGsyQfi7UmuqCoF1I", cchWideChar=23, lpMultiByteStr=0x38c4d0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TRxzM0DGsyQfi7UmuqCoF1I", lpUsedDefaultChar=0x0) returned 23 [0258.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0258.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0258.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0258.793] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0258.793] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\office16\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0258.794] WriteFile (in: hFile=0x56c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6a, lpOverlapped=0x0) returned 1 [0258.795] CloseHandle (hObject=0x56c) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19600 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0258.795] CryptDestroyKey (hKey=0x5261088) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a480 | out: hHeap=0x310000) returned 1 [0258.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351930 | out: hHeap=0x310000) returned 1 [0258.795] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0258.795] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0258.796] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.796] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0258.798] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.798] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0258.798] CloseHandle (hObject=0x56c) returned 1 [0258.798] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b280 [0258.798] RmStartSession () returned 0x0 [0258.800] RmRegisterResources () returned 0x0 [0258.800] RmGetList () returned 0x0 [0259.163] RmShutdown () returned 0x0 [0260.742] RmEndSession () returned 0x0 [0260.917] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261008) returned 1 [0260.917] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0260.917] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0260.917] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0260.917] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0260.917] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=1261) returned 1 [0260.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0260.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2b020 [0260.973] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0260.973] GetLastError () returned 0x0 [0260.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0260.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0260.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c3e0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0260.973] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60ff2d0 | out: hHeap=0x310000) returned 1 [0260.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0260.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54ec758 [0260.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0260.973] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0260.974] WriteFile (in: hFile=0x56c, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe71, lpOverlapped=0x0) returned 1 [0260.975] CloseHandle (hObject=0x56c) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05358 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f348 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f045c0 | out: hHeap=0x310000) returned 1 [0260.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0260.975] CryptDestroyKey (hKey=0x5261008) returned 1 [0260.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b280 | out: hHeap=0x310000) returned 1 [0260.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9c88 | out: hHeap=0x310000) returned 1 [0260.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53519d0 | out: hHeap=0x310000) returned 1 [0260.976] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0260.976] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0261.158] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.158] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0261.163] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.164] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0261.164] CloseHandle (hObject=0x668) returned 1 [0261.164] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b280 [0261.164] RmStartSession () returned 0x0 [0261.167] RmRegisterResources () returned 0x0 [0261.170] RmGetList () returned 0x0 [0262.830] RmShutdown () returned 0x0 [0265.348] RmEndSession () returned 0x0 [0265.733] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261488) returned 1 [0265.733] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0265.733] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0265.733] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0265.733] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0265.733] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=1261) returned 1 [0265.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0265.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ee020 [0265.757] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0265.757] GetLastError () returned 0x0 [0265.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0265.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x2daf890, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0265.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0265.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0265.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0265.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0265.758] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0265.759] WriteFile (in: hFile=0x484, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe61, lpOverlapped=0x0) returned 1 [0265.759] CloseHandle (hObject=0x484) returned 1 [0265.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0265.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04c18 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5399e08 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04138 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0265.760] CryptDestroyKey (hKey=0x5261488) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b280 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348d48 | out: hHeap=0x310000) returned 1 [0265.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351fc0 | out: hHeap=0x310000) returned 1 [0265.760] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0265.760] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0265.760] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.760] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0265.792] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.792] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0265.792] CloseHandle (hObject=0x484) returned 1 [0265.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b280 [0265.792] RmStartSession () returned 0x0 [0265.794] RmRegisterResources () returned 0x0 [0265.794] RmGetList () returned 0x0 [0266.190] RmShutdown () returned 0x0 [0267.454] RmEndSession () returned 0x0 [0267.455] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261548) returned 1 [0267.455] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0267.455] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0267.455] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0267.456] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0267.456] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=1261) returned 1 [0267.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0267.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c6020 [0267.784] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0267.784] GetLastError () returned 0x0 [0267.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0267.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0267.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x38c390, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3PiqIn2wVpHXSiax4SL", lpUsedDefaultChar=0x0) returned 20 [0267.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0267.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0267.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0267.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0267.784] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0267.785] WriteFile (in: hFile=0x484, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe67, lpOverlapped=0x0) returned 1 [0267.786] CloseHandle (hObject=0x484) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba0400 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539c1e0 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0267.786] CryptDestroyKey (hKey=0x5261548) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b280 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53493a0 | out: hHeap=0x310000) returned 1 [0267.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ca0 | out: hHeap=0x310000) returned 1 [0267.786] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0267.786] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0267.788] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.789] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0267.797] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.797] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0267.797] CloseHandle (hObject=0x484) returned 1 [0267.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0267.797] RmStartSession () returned 0x0 [0267.798] RmRegisterResources () returned 0x0 [0267.798] RmGetList () returned 0x0 [0267.841] RmShutdown () returned 0x0 [0267.878] RmEndSession () returned 0x0 [0267.878] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261448) returned 1 [0267.879] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0267.879] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF", dwFileAttributes=0x220) returned 1 [0267.879] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0267.879] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0267.879] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=11891) returned 1 [0267.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0267.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cf020 [0269.566] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0269.566] GetLastError () returned 0x0 [0269.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0269.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0269.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x38c160, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1f15BUaqm7XqtONc8btxaBe3", lpUsedDefaultChar=0x0) returned 24 [0269.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89320 | out: hHeap=0x310000) returned 1 [0269.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0269.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0269.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0269.567] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0269.568] WriteFile (in: hFile=0x484, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6b, lpOverlapped=0x0) returned 1 [0269.569] CloseHandle (hObject=0x484) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0269.569] CryptDestroyKey (hKey=0x5261448) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c6a8 | out: hHeap=0x310000) returned 1 [0269.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2f00 | out: hHeap=0x310000) returned 1 [0269.569] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0269.569] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0269.570] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.570] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0269.598] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.598] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0269.598] CloseHandle (hObject=0x484) returned 1 [0269.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0269.598] RmStartSession () returned 0x0 [0269.599] RmRegisterResources () returned 0x0 [0269.604] RmGetList () returned 0x0 [0270.767] RmShutdown () returned 0x0 [0271.976] RmEndSession () returned 0x0 [0271.977] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261688) returned 1 [0271.978] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0271.978] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF", dwFileAttributes=0x220) returned 1 [0271.978] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0271.978] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0271.978] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=10607) returned 1 [0271.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b29e38 [0271.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e6020 [0274.694] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0274.695] GetLastError () returned 0x0 [0274.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0274.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x2daf890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0274.695] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0274.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0274.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0274.695] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0274.696] WriteFile (in: hFile=0x484, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5e, lpOverlapped=0x0) returned 1 [0274.697] CloseHandle (hObject=0x484) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cad90 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0274.697] CryptDestroyKey (hKey=0x5261688) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4db0 | out: hHeap=0x310000) returned 1 [0274.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3360 | out: hHeap=0x310000) returned 1 [0274.697] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0274.697] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0274.697] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.697] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0274.708] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.708] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0274.708] CloseHandle (hObject=0x484) returned 1 [0274.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0274.708] RmStartSession () returned 0x0 [0274.710] RmRegisterResources () returned 0x0 [0274.710] RmGetList () returned 0x0 [0274.752] RmShutdown () returned 0x0 [0275.400] RmEndSession () returned 0x0 [0275.489] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261688) returned 1 [0275.490] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0275.490] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF", dwFileAttributes=0x220) returned 1 [0275.490] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0275.490] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0275.490] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=14428) returned 1 [0275.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0275.531] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0275.531] GetLastError () returned 0x0 [0275.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x2daf890, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0275.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0275.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.531] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0275.532] WriteFile (in: hFile=0x484, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe5e, lpOverlapped=0x0) returned 1 [0275.533] CloseHandle (hObject=0x484) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cee568 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0275.533] CryptDestroyKey (hKey=0x5261688) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5e50 | out: hHeap=0x310000) returned 1 [0275.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3810 | out: hHeap=0x310000) returned 1 [0275.533] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0275.533] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0275.534] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.534] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0275.622] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.622] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0275.622] CloseHandle (hObject=0x484) returned 1 [0275.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0275.622] RmStartSession () returned 0x0 [0275.623] RmRegisterResources () returned 0x0 [0275.623] RmGetList () returned 0x0 [0276.553] RmShutdown () returned 0x0 [0277.674] RmEndSession () returned 0x0 [0277.674] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261ac8) returned 1 [0277.674] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0277.675] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF", dwFileAttributes=0x220) returned 1 [0277.675] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0277.675] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0277.675] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=1832) returned 1 [0277.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0277.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e4020 [0277.694] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0277.694] GetLastError () returned 0x0 [0277.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0277.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0277.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c070, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0277.695] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0277.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0277.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0277.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.695] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0277.696] WriteFile (in: hFile=0x484, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe68, lpOverlapped=0x0) returned 1 [0277.696] CloseHandle (hObject=0x484) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0277.697] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a64d8 | out: hHeap=0x310000) returned 1 [0277.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1fb0 | out: hHeap=0x310000) returned 1 [0277.697] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0277.697] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0277.697] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.697] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0277.707] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.707] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0277.708] CloseHandle (hObject=0x484) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0277.708] RmStartSession () returned 0x0 [0277.708] RmRegisterResources () returned 0x0 [0277.709] RmGetList () returned 0x0 [0278.807] RmShutdown () returned 0x0 [0281.005] RmEndSession () returned 0x0 [0281.006] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x35db88) returned 1 [0281.006] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0281.006] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF", dwFileAttributes=0x220) returned 1 [0281.007] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0281.007] CryptEncrypt (in: hKey=0x35db88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0281.007] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=2108) returned 1 [0281.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0281.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5893020 [0281.774] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0281.774] ReadFile (in: hFile=0x484, lpBuffer=0x5893040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x5893040*, lpNumberOfBytesRead=0x2dafa58*=0x83c, lpOverlapped=0x0) returned 1 [0281.775] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0281.775] CryptEncrypt (in: hKey=0x35db88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0281.775] WriteFile (in: hFile=0x484, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0281.776] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0281.776] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0281.776] WriteFile (in: hFile=0x484, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0281.776] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5893020 | out: hHeap=0x310000) returned 1 [0283.180] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0283.180] CloseHandle (hObject=0x484) returned 1 [0283.181] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0283.181] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0283.181] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a48f0 [0283.181] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0283.181] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0283.181] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0283.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4690 [0283.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0283.193] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0283.193] GetLastError () returned 0x0 [0283.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0283.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x2daf890, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1tVbp", lpUsedDefaultChar=0x0) returned 5 [0283.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0283.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0283.194] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0283.195] WriteFile (in: hFile=0x484, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2daf9cc*=0xe58, lpOverlapped=0x0) returned 1 [0283.196] CloseHandle (hObject=0x484) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4690 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a48f0 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0283.196] CryptDestroyKey (hKey=0x35db88) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6608 | out: hHeap=0x310000) returned 1 [0283.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1d30 | out: hHeap=0x310000) returned 1 [0283.196] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0283.196] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0283.196] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.196] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0283.201] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.201] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0283.201] CloseHandle (hObject=0x484) returned 1 [0283.201] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0283.201] RmStartSession () returned 0x0 [0283.204] RmRegisterResources () returned 0x0 [0283.204] RmGetList () returned 0x0 [0284.754] RmShutdown () returned 0x0 [0285.912] RmEndSession () returned 0x0 [0285.915] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5261348) returned 1 [0285.915] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0285.915] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x220) returned 1 [0285.915] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0285.915] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0285.915] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=17236) returned 1 [0285.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c0f008 [0285.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7a2d020 [0286.971] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0286.971] ReadFile (in: hFile=0x484, lpBuffer=0x7a2d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x7a2d040*, lpNumberOfBytesRead=0x2dafa58*=0x4354, lpOverlapped=0x0) returned 1 [0286.975] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0286.975] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0286.975] WriteFile (in: hFile=0x484, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0286.975] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0286.975] WriteFile (in: hFile=0x484, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0286.975] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0286.975] WriteFile (in: hFile=0x484, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0286.976] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0286.976] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0286.976] WriteFile (in: hFile=0x484, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0286.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7a2d020 | out: hHeap=0x310000) returned 1 [0289.858] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c0f008 | out: hHeap=0x310000) returned 1 [0289.858] CloseHandle (hObject=0x484) returned 1 [0289.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0289.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c38b0 [0289.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4be8 [0289.859] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4378 [0289.859] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c38b0 | out: hHeap=0x310000) returned 1 [0289.859] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5990 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.860] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0289.860] GetLastError () returned 0x0 [0289.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0289.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c160, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0289.860] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e370 | out: hHeap=0x310000) returned 1 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0289.860] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.860] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0289.861] WriteFile (in: hFile=0x484, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2daf9cc*=0xe6f, lpOverlapped=0x0) returned 1 [0289.862] CloseHandle (hObject=0x484) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5990 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4378 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4be8 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0289.862] CryptDestroyKey (hKey=0x5261348) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0289.862] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c946d0 | out: hHeap=0x310000) returned 1 [0289.863] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e29b0 | out: hHeap=0x310000) returned 1 [0289.863] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0289.863] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0289.863] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.863] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0289.874] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.875] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0289.875] CloseHandle (hObject=0x484) returned 1 [0289.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5568 [0289.875] RmStartSession () returned 0x0 [0290.297] RmRegisterResources () returned 0x0 [0290.297] RmGetList () returned 0x0 [0290.470] RmShutdown () returned 0x0 [0291.573] RmEndSession () returned 0x0 [0291.574] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x35de48) returned 1 [0291.574] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0291.574] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF", dwFileAttributes=0x220) returned 1 [0291.574] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0291.574] CryptEncrypt (in: hKey=0x35de48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0291.574] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=1012) returned 1 [0291.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c0f008 [0291.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6218020 [0292.294] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0292.294] ReadFile (in: hFile=0x564, lpBuffer=0x6218040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6218040*, lpNumberOfBytesRead=0x2dafa58*=0x3f4, lpOverlapped=0x0) returned 1 [0292.294] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0292.294] CryptEncrypt (in: hKey=0x35de48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0292.294] WriteFile (in: hFile=0x564, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0292.307] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0292.307] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0292.307] WriteFile (in: hFile=0x564, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0292.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6218020 | out: hHeap=0x310000) returned 1 [0292.563] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c0f008 | out: hHeap=0x310000) returned 1 [0292.563] CloseHandle (hObject=0x564) returned 1 [0292.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0292.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4fb0 [0292.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0292.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5290 [0292.564] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4fb0 | out: hHeap=0x310000) returned 1 [0292.564] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0292.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0292.565] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0292.565] GetLastError () returned 0x0 [0292.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x2daf890, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0292.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.565] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0292.566] WriteFile (in: hFile=0x564, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2daf9cc*=0xe56, lpOverlapped=0x0) returned 1 [0292.567] CloseHandle (hObject=0x564) returned 1 [0292.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0292.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0292.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0292.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5290 | out: hHeap=0x310000) returned 1 [0292.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0292.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0292.568] CryptDestroyKey (hKey=0x35de48) returned 1 [0292.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5568 | out: hHeap=0x310000) returned 1 [0292.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95348 | out: hHeap=0x310000) returned 1 [0292.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a178 | out: hHeap=0x310000) returned 1 [0292.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0292.568] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0292.568] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.568] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0292.574] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.574] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0292.574] CloseHandle (hObject=0x564) returned 1 [0292.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a57c8 [0292.574] RmStartSession () returned 0x0 [0293.555] RmRegisterResources () returned 0x0 [0293.556] RmGetList () returned 0x0 [0293.904] RmShutdown () returned 0x0 [0295.381] RmEndSession () returned 0x0 [0295.381] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2dafb58 | out: phKey=0x2dafb58*=0x5260f88) returned 1 [0295.381] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0295.382] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF", dwFileAttributes=0x220) returned 1 [0295.382] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0295.382] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2daf9b8*=0x2000) returned 1 [0295.382] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2dafa50 | out: lpFileSize=0x2dafa50*=5272) returned 1 [0295.382] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0295.382] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6215020 [0296.288] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0296.288] ReadFile (in: hFile=0x5e8, lpBuffer=0x6215040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2dafa58, lpOverlapped=0x0 | out: lpBuffer=0x6215040*, lpNumberOfBytesRead=0x2dafa58*=0x1498, lpOverlapped=0x0) returned 1 [0296.289] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa40 | out: lpNewFilePointer=0x0) returned 1 [0296.289] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2daf9cc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2daf9cc*=0x2000) returned 1 [0296.289] WriteFile (in: hFile=0x5e8, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2dafa5c*=0x2000, lpOverlapped=0x0) returned 1 [0296.289] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafa48 | out: lpNewFilePointer=0x0) returned 1 [0296.289] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2dafa5c*=0x200, lpOverlapped=0x0) returned 1 [0296.289] WriteFile (in: hFile=0x5e8, lpBuffer=0x2daf9f8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x2daf9f8*, lpNumberOfBytesWritten=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0296.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6215020 | out: hHeap=0x310000) returned 1 [0296.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0296.295] CloseHandle (hObject=0x5e8) returned 1 [0296.295] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0296.295] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf520 [0296.295] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94f20 [0296.295] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c02c8 [0296.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf520 | out: hHeap=0x310000) returned 1 [0296.295] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0296.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94b90 [0296.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0296.296] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2daf82c | out: lpSystemTimeAsFileTime=0x2daf82c) [0296.296] GetLastError () returned 0x0 [0296.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0296.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0296.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x38c390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e0sG9NpfUiifqv54", lpUsedDefaultChar=0x0) returned 16 [0296.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b688 | out: hHeap=0x310000) returned 1 [0296.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0296.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0296.297] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0296.297] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0296.298] WriteFile (in: hFile=0x5e8, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2daf9cc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2daf9cc*=0xe63, lpOverlapped=0x0) returned 1 [0296.298] CloseHandle (hObject=0x5e8) returned 1 [0296.298] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94b90 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c02c8 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94f20 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0296.299] CryptDestroyKey (hKey=0x5260f88) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a57c8 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306a40 | out: hHeap=0x310000) returned 1 [0296.299] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609e08 | out: hHeap=0x310000) returned 1 [0296.299] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2dafb8c, lpCompletionKey=0x2dafb90, lpOverlapped=0x2dafb88) returned 1 [0296.299] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0296.299] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa60 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.299] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa5c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa5c*=0x18, lpOverlapped=0x0) returned 1 [0296.301] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.301] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2dafa50, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2dafa50*=0x18, lpOverlapped=0x0) returned 1 [0296.301] CloseHandle (hObject=0x5e8) returned 1 [0296.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94b90 [0296.301] RmStartSession () returned 0x0 [0296.304] RmRegisterResources () returned 0x0 [0296.315] RmGetList () returned 0x0 [0298.956] RmShutdown () Thread: id = 5 os_tid = 0x13fc [0068.584] GetLastError () returned 0x57 [0068.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x346bd0 [0068.584] SetLastError (dwErrCode=0x57) [0068.584] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0070.882] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0086.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0093.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0097.963] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0102.166] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0103.173] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0108.723] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0127.651] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0128.656] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0129.664] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0130.686] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0131.701] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0132.740] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 0 [0133.783] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0134.109] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0134.112] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.112] ReadFile (in: hFile=0x4cc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0134.155] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.155] ReadFile (in: hFile=0x4cc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0134.155] CloseHandle (hObject=0x4cc) returned 1 [0134.156] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae78 [0134.156] RmStartSession () returned 0x0 [0134.160] RmRegisterResources () returned 0x0 [0134.177] RmGetList () returned 0x0 [0135.775] RmShutdown () returned 0x0 [0139.503] RmEndSession () returned 0x0 [0139.506] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x35dc88) returned 1 [0139.506] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0139.506] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x20) returned 1 [0139.507] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0139.507] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0139.507] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=40) returned 1 [0139.507] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ade80 [0139.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6552020 [0139.907] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0139.907] ReadFile (in: hFile=0x4d4, lpBuffer=0x6552040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6552040*, lpNumberOfBytesRead=0x2eef988*=0x28, lpOverlapped=0x0) returned 1 [0139.908] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0139.908] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54adea0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54adea0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0139.908] WriteFile (in: hFile=0x4d4, lpBuffer=0x54adea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54adea0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0139.909] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0139.910] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0139.910] WriteFile (in: hFile=0x4d4, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0139.910] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6552020 | out: hHeap=0x310000) returned 1 [0141.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ade80 | out: hHeap=0x310000) returned 1 [0141.640] CloseHandle (hObject=0x4d4) returned 1 [0141.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0141.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365198 [0141.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0141.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0141.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365198 | out: hHeap=0x310000) returned 1 [0141.642] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.bdcddcbaad"), dwFlags=0x1) returned 1 [0141.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39afe0 [0141.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0141.643] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.644] SetLastError (dwErrCode=0x0) [0141.644] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bc00 [0141.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.645] SetLastError (dwErrCode=0x0) [0141.645] GetLastError () returned 0x0 [0141.646] SetLastError (dwErrCode=0x0) [0141.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0141.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0141.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x38c188, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RvQ78znxAxbgIhBd7BJgQH", lpUsedDefaultChar=0x0) returned 22 [0141.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bc00 | out: hHeap=0x310000) returned 1 [0141.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0141.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5eb4088 [0141.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0141.646] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0141.647] WriteFile (in: hFile=0x4d4, lpBuffer=0x5eb4088*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x5eb4088*, lpNumberOfBytesWritten=0x2eef8fc*=0xe69, lpOverlapped=0x0) returned 1 [0141.648] CloseHandle (hObject=0x4d4) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5eb4088 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39afe0 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0141.649] CryptDestroyKey (hKey=0x35dc88) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae78 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac98 | out: hHeap=0x310000) returned 1 [0141.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365818 | out: hHeap=0x310000) returned 1 [0141.649] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0141.649] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0141.650] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.650] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0141.651] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.651] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0141.652] CloseHandle (hObject=0x4d4) returned 1 [0141.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0141.652] RmStartSession () returned 0x0 [0141.654] RmRegisterResources () returned 0x0 [0141.660] RmGetList () returned 0x0 [0141.968] RmShutdown () returned 0x0 [0145.242] RmEndSession () returned 0x0 [0145.243] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260cc8) returned 1 [0145.244] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0145.244] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x80) returned 1 [0145.244] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0145.244] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0145.244] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=6851) returned 1 [0145.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5609010 [0145.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cf020 [0145.613] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0145.613] ReadFile (in: hFile=0x4d4, lpBuffer=0x65cf040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x65cf040*, lpNumberOfBytesRead=0x2eef988*=0x1ac3, lpOverlapped=0x0) returned 1 [0145.614] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0145.614] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5609020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5609020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0145.614] WriteFile (in: hFile=0x4d4, lpBuffer=0x5609020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5609020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0145.614] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0145.614] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0145.615] WriteFile (in: hFile=0x4d4, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0145.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65cf020 | out: hHeap=0x310000) returned 1 [0145.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609010 | out: hHeap=0x310000) returned 1 [0145.765] CloseHandle (hObject=0x4d4) returned 1 [0145.766] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0145.766] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1e98 [0145.766] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398ed8 [0145.766] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0145.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0145.766] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1037\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0145.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0145.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398068 [0145.769] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.769] SetLastError (dwErrCode=0x0) [0145.769] GetLastError () returned 0x0 [0145.770] SetLastError (dwErrCode=0x0) [0145.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0145.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x2eef7c0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0145.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0145.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19b28 [0145.770] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0145.770] WriteFile (in: hFile=0x4d4, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x2eef8fc*=0xe59, lpOverlapped=0x0) returned 1 [0145.771] CloseHandle (hObject=0x4d4) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19b28 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398068 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0145.772] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3994b0 | out: hHeap=0x310000) returned 1 [0145.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19150 | out: hHeap=0x310000) returned 1 [0145.772] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0145.772] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0145.772] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.773] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0145.774] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.774] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0145.774] CloseHandle (hObject=0x4d4) returned 1 [0145.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398ed8 [0145.774] RmStartSession () returned 0x0 [0145.777] RmRegisterResources () returned 0x0 [0145.781] RmGetList () returned 0x0 [0146.090] RmShutdown () returned 0x0 [0146.906] RmEndSession () returned 0x0 [0146.907] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f88) returned 1 [0146.907] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0146.907] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x80) returned 1 [0146.908] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0146.908] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0146.908] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=3683) returned 1 [0146.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0146.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6653020 [0146.927] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0146.927] ReadFile (in: hFile=0x4d4, lpBuffer=0x6653040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6653040*, lpNumberOfBytesRead=0x2eef988*=0xe63, lpOverlapped=0x0) returned 1 [0146.929] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0146.929] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0146.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0146.930] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0146.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0146.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0146.930] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6653020 | out: hHeap=0x310000) returned 1 [0146.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0146.935] CloseHandle (hObject=0x4d4) returned 1 [0146.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0146.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0146.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3994b0 [0146.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2108 [0146.936] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0146.936] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1046\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0146.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3996c0 [0146.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398068 [0146.989] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0146.989] GetLastError () returned 0x0 [0146.989] SetLastError (dwErrCode=0x0) [0146.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb8a8 [0146.989] GetLastError () returned 0x0 [0146.989] SetLastError (dwErrCode=0x0) [0146.989] GetLastError () returned 0x0 [0146.989] SetLastError (dwErrCode=0x0) [0146.989] GetLastError () returned 0x0 [0146.989] SetLastError (dwErrCode=0x0) [0146.989] GetLastError () returned 0x0 [0146.989] SetLastError (dwErrCode=0x0) [0146.989] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0146.990] GetLastError () returned 0x0 [0146.990] SetLastError (dwErrCode=0x0) [0146.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0146.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0146.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x2eef7c0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aA4HcB1IE", lpUsedDefaultChar=0x0) returned 9 [0146.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0146.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0146.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0146.990] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0146.991] WriteFile (in: hFile=0x4d4, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x2eef8fc*=0xe5c, lpOverlapped=0x0) returned 1 [0146.992] CloseHandle (hObject=0x4d4) returned 1 [0146.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398068 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3996c0 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2108 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3994b0 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0146.993] CryptDestroyKey (hKey=0x5260f88) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399878 | out: hHeap=0x310000) returned 1 [0146.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18d40 | out: hHeap=0x310000) returned 1 [0146.993] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0146.993] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0146.993] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.993] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0147.202] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.202] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0147.202] CloseHandle (hObject=0x4d4) returned 1 [0147.203] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0147.203] RmStartSession () returned 0x0 [0147.252] RmRegisterResources () returned 0x0 [0147.256] RmGetList () returned 0x0 [0147.832] RmShutdown () returned 0x0 [0149.885] RmEndSession () returned 0x0 [0149.886] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260e88) returned 1 [0149.886] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0149.886] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0149.887] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0149.887] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0149.887] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=76818) returned 1 [0149.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3a4b20 [0149.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590d020 [0150.018] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0150.019] ReadFile (in: hFile=0x4d4, lpBuffer=0x590d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x590d040*, lpNumberOfBytesRead=0x2eef988*=0x12c12, lpOverlapped=0x0) returned 1 [0150.022] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0150.022] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.022] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.022] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.022] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.022] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.022] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.023] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0150.024] WriteFile (in: hFile=0x4d4, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0150.024] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0150.024] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0150.024] WriteFile (in: hFile=0x4d4, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0150.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590d020 | out: hHeap=0x310000) returned 1 [0150.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b20 | out: hHeap=0x310000) returned 1 [0150.068] CloseHandle (hObject=0x4d4) returned 1 [0150.070] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0150.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2d68 [0150.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0150.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0150.071] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0150.071] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1055\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1fd0 [0150.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398188 [0150.071] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a35e8 [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.072] SetLastError (dwErrCode=0x0) [0150.072] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0150.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] GetLastError () returned 0x0 [0150.073] SetLastError (dwErrCode=0x0) [0150.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a35e8 | out: hHeap=0x310000) returned 1 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0150.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x38c390, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9XOqcHODkUzIb3wxAPZ", lpUsedDefaultChar=0x0) returned 19 [0150.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0150.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0150.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c3a390 [0150.073] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1055\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0150.074] WriteFile (in: hFile=0x4d4, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x2eef8fc*=0xe66, lpOverlapped=0x0) returned 1 [0150.075] CloseHandle (hObject=0x4d4) returned 1 [0150.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a390 | out: hHeap=0x310000) returned 1 [0150.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0150.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0150.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0150.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398188 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1fd0 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0150.076] CryptDestroyKey (hKey=0x5260e88) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50609d8 | out: hHeap=0x310000) returned 1 [0150.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c197e0 | out: hHeap=0x310000) returned 1 [0150.076] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0150.076] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0150.076] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.076] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0150.126] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.126] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0150.126] CloseHandle (hObject=0x4d4) returned 1 [0150.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0150.126] RmStartSession () returned 0x0 [0150.205] RmRegisterResources () returned 0x0 [0150.206] RmGetList () returned 0x0 [0150.770] RmShutdown () returned 0x0 [0154.921] RmEndSession () returned 0x0 [0154.991] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f08) returned 1 [0154.991] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0154.992] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x80) returned 1 [0154.992] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0154.992] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0154.993] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=16118) returned 1 [0154.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3a4b20 [0154.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5901020 [0155.013] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0155.013] ReadFile (in: hFile=0x674, lpBuffer=0x5901040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x5901040*, lpNumberOfBytesRead=0x2eef988*=0x3ef6, lpOverlapped=0x0) returned 1 [0155.145] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0155.145] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0155.145] WriteFile (in: hFile=0x674, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0155.145] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0155.145] WriteFile (in: hFile=0x674, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0155.146] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0155.146] WriteFile (in: hFile=0x674, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0155.146] WriteFile (in: hFile=0x674, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0155.147] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5901020 | out: hHeap=0x310000) returned 1 [0155.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b20 | out: hHeap=0x310000) returned 1 [0155.270] CloseHandle (hObject=0x674) returned 1 [0155.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0155.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0155.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0155.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0155.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0155.277] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\\\588bce7c90097ed212\\DHtmlHeader.html.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.bdcddcbaad"), dwFlags=0x1) returned 1 [0155.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0155.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0155.278] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0155.279] GetLastError () returned 0x0 [0155.279] SetLastError (dwErrCode=0x0) [0155.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0155.279] GetLastError () returned 0x0 [0155.279] SetLastError (dwErrCode=0x0) [0155.279] GetLastError () returned 0x0 [0155.279] SetLastError (dwErrCode=0x0) [0155.279] GetLastError () returned 0x0 [0155.279] SetLastError (dwErrCode=0x0) [0155.279] GetLastError () returned 0x0 [0155.279] SetLastError (dwErrCode=0x0) [0155.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0155.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rdv", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0155.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rdv", cchWideChar=3, lpMultiByteStr=0x2eef7c0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rdv", lpUsedDefaultChar=0x0) returned 3 [0155.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0155.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0155.280] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0155.281] WriteFile (in: hFile=0x674, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x2eef8fc*=0xe56, lpOverlapped=0x0) returned 1 [0155.282] CloseHandle (hObject=0x674) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0155.283] CryptDestroyKey (hKey=0x5260f08) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5100 | out: hHeap=0x310000) returned 1 [0155.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0155.283] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0155.284] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0155.284] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.284] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0155.286] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.286] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0155.286] CloseHandle (hObject=0x674) returned 1 [0155.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a27f0 [0155.286] RmStartSession () returned 0x0 [0156.307] RmRegisterResources () returned 0x0 [0156.314] RmGetList () returned 0x0 [0157.489] RmShutdown () returned 0x0 [0159.123] RmEndSession () returned 0x0 [0159.219] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f08) returned 1 [0159.219] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0159.219] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x20) returned 1 [0159.219] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0159.219] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0159.219] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=43131591) returned 1 [0159.219] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0159.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57f2020 [0159.240] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0159.241] ReadFile (in: hFile=0x630, lpBuffer=0x57f2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x57f2040*, lpNumberOfBytesRead=0x2eef988*=0x100000, lpOverlapped=0x0) returned 1 [0159.742] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0159.742] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.742] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.743] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.743] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.744] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.745] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.745] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.746] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.746] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.747] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.747] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.748] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.748] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.749] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.749] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.750] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.750] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.751] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.751] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.751] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.751] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.751] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.752] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.752] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.753] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.753] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.754] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.754] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.755] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.755] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.756] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.756] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.757] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.757] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.758] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.758] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.759] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.760] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.760] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.879] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.879] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.879] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.879] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.879] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.880] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.880] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0159.881] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0159.881] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0164.025] WriteFile (in: hFile=0x630, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0164.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57f2020 | out: hHeap=0x310000) returned 1 [0164.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0164.537] CloseHandle (hObject=0x630) returned 1 [0167.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0167.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0167.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0167.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0167.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0167.742] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.bdcddcbaad"), dwFlags=0x1) returned 1 [0167.742] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0167.742] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c370 [0167.742] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0167.742] GetLastError () returned 0x0 [0167.742] SetLastError (dwErrCode=0x0) [0167.743] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.743] SetLastError (dwErrCode=0x0) [0167.743] GetLastError () returned 0x0 [0167.744] SetLastError (dwErrCode=0x0) [0167.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0167.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4kIpbNZFMYmzjk", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0167.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4kIpbNZFMYmzjk", cchWideChar=14, lpMultiByteStr=0x2eef7c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4kIpbNZFMYmzjk", lpUsedDefaultChar=0x0) returned 14 [0167.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0167.744] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0167.744] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bab400 [0167.744] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2580 [0167.744] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0167.745] WriteFile (in: hFile=0x630, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x2eef8fc*=0xe61, lpOverlapped=0x0) returned 1 [0167.746] CloseHandle (hObject=0x630) returned 1 [0167.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2580 | out: hHeap=0x310000) returned 1 [0167.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c370 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0167.747] CryptDestroyKey (hKey=0x5260f08) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a27f0 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a29f8 | out: hHeap=0x310000) returned 1 [0167.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5c10 | out: hHeap=0x310000) returned 1 [0167.747] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0167.747] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0167.748] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.749] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0167.750] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.750] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0167.750] CloseHandle (hObject=0x630) returned 1 [0167.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4110 [0167.750] RmStartSession () returned 0x0 [0167.880] RmRegisterResources () returned 0x0 [0167.884] RmGetList () returned 0x0 [0170.043] RmShutdown () returned 0x0 [0173.629] RmEndSession () returned 0x0 [0173.630] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261308) returned 1 [0173.630] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0173.630] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0173.630] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0173.630] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0173.631] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=1118208) returned 1 [0173.631] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5dfdd28 [0173.631] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58de020 [0173.993] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0173.993] ReadFile (in: hFile=0x630, lpBuffer=0x58de040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x58de040*, lpNumberOfBytesRead=0x2eef988*=0x100000, lpOverlapped=0x0) returned 1 [0174.036] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0174.036] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.036] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.036] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.036] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.036] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.036] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.036] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.036] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.037] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.037] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.038] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.038] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.039] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.039] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.040] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.040] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.041] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.041] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.042] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.042] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.043] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.043] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.044] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.044] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.045] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.045] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.046] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.046] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.046] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.046] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.046] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.046] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.047] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.048] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.048] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.049] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.049] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.050] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.051] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.051] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.052] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.052] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.053] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.053] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5dfdd40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0174.054] WriteFile (in: hFile=0x630, lpBuffer=0x5dfdd40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5dfdd40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0174.054] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0x630, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0174.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58de020 | out: hHeap=0x310000) returned 1 [0174.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dfdd28 | out: hHeap=0x310000) returned 1 [0174.920] CloseHandle (hObject=0x630) returned 1 [0174.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0174.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321fd8 [0174.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3cd0 [0174.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53215c0 [0174.944] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321fd8 | out: hHeap=0x310000) returned 1 [0174.944] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0174.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3c48 [0174.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0174.945] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4330 [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] GetLastError () returned 0x0 [0174.945] SetLastError (dwErrCode=0x0) [0174.945] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4330 | out: hHeap=0x310000) returned 1 [0174.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0174.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x2eef7c0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37XpR", lpUsedDefaultChar=0x0) returned 5 [0174.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0174.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0174.945] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0174.946] WriteFile (in: hFile=0x630, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x2eef8fc*=0xe58, lpOverlapped=0x0) returned 1 [0174.947] CloseHandle (hObject=0x630) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3c48 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53215c0 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3cd0 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0174.948] CryptDestroyKey (hKey=0x5261308) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4110 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0174.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6790 | out: hHeap=0x310000) returned 1 [0174.948] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0174.948] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0174.949] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.949] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0175.699] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.702] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0175.703] CloseHandle (hObject=0x630) returned 1 [0175.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0720 [0175.703] RmStartSession () returned 0x0 [0175.704] RmRegisterResources () returned 0x0 [0176.949] RmGetList () returned 0x0 [0180.515] RmShutdown () returned 0x0 [0182.787] RmEndSession () returned 0x0 [0182.982] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260e48) returned 1 [0182.982] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0182.983] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0182.983] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0182.983] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0182.983] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=69632) returned 1 [0182.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5415ce0 [0182.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5835020 [0183.001] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0183.001] ReadFile (in: hFile=0x630, lpBuffer=0x5835040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x5835040*, lpNumberOfBytesRead=0x2eef988*=0x11000, lpOverlapped=0x0) returned 1 [0183.042] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.042] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.042] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.043] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.043] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.043] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.043] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.043] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0183.043] WriteFile (in: hFile=0x630, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0183.043] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0183.043] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0183.043] WriteFile (in: hFile=0x630, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0183.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5835020 | out: hHeap=0x310000) returned 1 [0183.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5415ce0 | out: hHeap=0x310000) returned 1 [0183.049] CloseHandle (hObject=0x630) returned 1 [0183.050] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0183.050] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0183.050] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0183.050] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0183.050] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0183.050] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0183.051] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0183.051] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0183.051] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0183.051] GetLastError () returned 0x0 [0183.051] SetLastError (dwErrCode=0x0) [0183.051] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0183.051] GetLastError () returned 0x0 [0183.051] SetLastError (dwErrCode=0x0) [0183.051] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.052] SetLastError (dwErrCode=0x0) [0183.052] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0183.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab5e8 [0183.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.053] SetLastError (dwErrCode=0x0) [0183.053] GetLastError () returned 0x0 [0183.054] SetLastError (dwErrCode=0x0) [0183.054] GetLastError () returned 0x0 [0183.054] SetLastError (dwErrCode=0x0) [0183.054] GetLastError () returned 0x0 [0183.054] SetLastError (dwErrCode=0x0) [0183.054] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0183.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0183.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0183.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x38c1b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", lpUsedDefaultChar=0x0) returned 31 [0183.054] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab5e8 | out: hHeap=0x310000) returned 1 [0183.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0183.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x540ab08 [0183.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397528 [0183.054] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0183.055] WriteFile (in: hFile=0x630, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x2eef8fc*=0xe72, lpOverlapped=0x0) returned 1 [0183.056] CloseHandle (hObject=0x630) returned 1 [0183.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0183.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0183.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0183.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0183.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0183.514] CryptDestroyKey (hKey=0x5260e48) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac98 | out: hHeap=0x310000) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6470 | out: hHeap=0x310000) returned 1 [0183.514] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0183.514] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0183.514] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.515] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0183.516] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.516] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0183.516] CloseHandle (hObject=0x670) returned 1 [0183.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0c48 [0183.516] RmStartSession () returned 0x0 [0183.732] RmRegisterResources () returned 0x0 [0183.736] RmGetList () returned 0x0 [0183.997] RmShutdown () returned 0x0 [0188.785] RmEndSession () returned 0x0 [0188.786] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261908) returned 1 [0188.786] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0188.786] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0188.786] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0188.786] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0188.786] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=69632) returned 1 [0188.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5413ca0 [0188.787] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6bb8020 [0189.111] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0189.111] ReadFile (in: hFile=0x670, lpBuffer=0x6bb8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6bb8040*, lpNumberOfBytesRead=0x2eef988*=0x11000, lpOverlapped=0x0) returned 1 [0189.115] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.115] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.115] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.116] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.116] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.116] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.116] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.116] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0189.116] WriteFile (in: hFile=0x670, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0189.116] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0189.116] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0189.116] WriteFile (in: hFile=0x670, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0189.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6bb8020 | out: hHeap=0x310000) returned 1 [0189.169] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5413ca0 | out: hHeap=0x310000) returned 1 [0189.169] CloseHandle (hObject=0x670) returned 1 [0189.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0189.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0189.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0189.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0189.171] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0189.171] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0189.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0189.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0189.172] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.172] GetLastError () returned 0x0 [0189.172] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0189.173] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] GetLastError () returned 0x0 [0189.173] SetLastError (dwErrCode=0x0) [0189.173] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0189.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0189.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x38c3b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3p1r5Y6j1RhQxDJosxt", lpUsedDefaultChar=0x0) returned 19 [0189.174] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0189.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0189.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5409c80 [0189.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0189.174] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0189.175] WriteFile (in: hFile=0x670, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x2eef8fc*=0xe66, lpOverlapped=0x0) returned 1 [0189.175] CloseHandle (hObject=0x670) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0189.176] CryptDestroyKey (hKey=0x5261908) returned 1 [0189.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0c48 | out: hHeap=0x310000) returned 1 [0189.177] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d08 | out: hHeap=0x310000) returned 1 [0189.177] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6ba0 | out: hHeap=0x310000) returned 1 [0189.177] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0189.177] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0189.177] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.177] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0189.196] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.196] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0189.196] CloseHandle (hObject=0x670) returned 1 [0189.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0189.196] RmStartSession () returned 0x0 [0189.197] RmRegisterResources () returned 0x0 [0189.201] RmGetList () returned 0x0 [0189.624] RmShutdown () returned 0x0 [0192.634] RmEndSession () returned 0x0 [0192.635] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x35d788) returned 1 [0192.635] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0192.635] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0192.635] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0192.635] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0192.635] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=69632) returned 1 [0192.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0192.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6215020 [0192.926] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0192.926] ReadFile (in: hFile=0x670, lpBuffer=0x6215040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6215040*, lpNumberOfBytesRead=0x2eef988*=0x11000, lpOverlapped=0x0) returned 1 [0192.931] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0192.931] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.931] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.931] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.931] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.931] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.931] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.931] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.931] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.931] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.931] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.932] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.932] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.932] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.932] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0192.932] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x670, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0192.933] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6215020 | out: hHeap=0x310000) returned 1 [0192.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0192.979] CloseHandle (hObject=0x670) returned 1 [0192.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0192.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0192.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0360 [0192.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532b0b8 [0192.981] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0192.981] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0192.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0540 [0192.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0192.982] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0192.982] GetLastError () returned 0x0 [0192.982] SetLastError (dwErrCode=0x0) [0192.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0192.982] GetLastError () returned 0x0 [0192.982] SetLastError (dwErrCode=0x0) [0192.982] GetLastError () returned 0x0 [0192.982] SetLastError (dwErrCode=0x0) [0192.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0192.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x2eef7c0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T", lpUsedDefaultChar=0x0) returned 1 [0192.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5409c80 [0192.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0192.982] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0192.983] WriteFile (in: hFile=0x670, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x2eef8fc*=0xe54, lpOverlapped=0x0) returned 1 [0192.984] CloseHandle (hObject=0x670) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532b0b8 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0192.985] CryptDestroyKey (hKey=0x35d788) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a050 | out: hHeap=0x310000) returned 1 [0192.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5a80 | out: hHeap=0x310000) returned 1 [0192.985] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0192.985] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0192.985] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.986] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.025] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0193.025] CloseHandle (hObject=0x670) returned 1 [0193.025] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61373b0 [0193.025] RmStartSession () returned 0x0 [0193.028] RmRegisterResources () returned 0x0 [0193.028] RmGetList () returned 0x0 [0194.328] RmShutdown () returned 0x0 [0198.007] RmEndSession () returned 0x0 [0198.008] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261788) returned 1 [0198.008] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0198.008] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml", dwFileAttributes=0x20) returned 1 [0198.009] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0198.009] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0198.009] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=4136) returned 1 [0198.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x611de98 [0198.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bb020 [0198.476] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0198.477] ReadFile (in: hFile=0x670, lpBuffer=0x64bb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x64bb040*, lpNumberOfBytesRead=0x2eef988*=0x1028, lpOverlapped=0x0) returned 1 [0198.479] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0198.479] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x611dea0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x611dea0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0198.479] WriteFile (in: hFile=0x670, lpBuffer=0x611dea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x611dea0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0198.479] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0198.479] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0198.479] WriteFile (in: hFile=0x670, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0198.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64bb020 | out: hHeap=0x310000) returned 1 [0198.606] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x611de98 | out: hHeap=0x310000) returned 1 [0198.606] CloseHandle (hObject=0x670) returned 1 [0198.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0198.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x4b82ad8 [0198.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7f140 [0198.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x4b82ba0 [0198.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b82ad8 | out: hHeap=0x310000) returned 1 [0198.607] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0198.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7f4d8 [0198.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cccd0 [0198.608] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51ccab0 [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.608] GetLastError () returned 0x0 [0198.608] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] GetLastError () returned 0x0 [0198.609] SetLastError (dwErrCode=0x0) [0198.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba78 [0198.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0198.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ccab0 | out: hHeap=0x310000) returned 1 [0198.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0198.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0198.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x38c188, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lRTaZqgzay52GZY8", lpUsedDefaultChar=0x0) returned 16 [0198.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba78 | out: hHeap=0x310000) returned 1 [0198.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0198.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0198.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6d48 [0198.610] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0198.611] WriteFile (in: hFile=0x670, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe63, lpOverlapped=0x0) returned 1 [0198.612] CloseHandle (hObject=0x670) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6d48 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cccd0 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7f4d8 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b82ba0 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7f140 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0198.613] CryptDestroyKey (hKey=0x5261788) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61373b0 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390a58 | out: hHeap=0x310000) returned 1 [0198.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44cb8 | out: hHeap=0x310000) returned 1 [0198.613] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0198.613] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0198.613] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.613] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0198.616] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.616] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0198.616] CloseHandle (hObject=0x670) returned 1 [0198.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6028 [0198.616] RmStartSession () returned 0x0 [0198.619] RmRegisterResources () returned 0x0 [0198.620] RmGetList () returned 0x0 [0200.338] RmShutdown () returned 0x0 [0204.733] RmEndSession () returned 0x0 [0204.877] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261708) returned 1 [0204.877] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0204.877] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui", dwFileAttributes=0x20) returned 0 [0204.877] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.877] CryptDestroyKey (hKey=0x5261708) returned 1 [0204.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6028 | out: hHeap=0x310000) returned 1 [0204.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93150 | out: hHeap=0x310000) returned 1 [0204.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07a60 | out: hHeap=0x310000) returned 1 [0204.877] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0204.877] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0204.954] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.954] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0204.955] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.955] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0204.955] CloseHandle (hObject=0x688) returned 1 [0204.955] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5f80 [0204.955] RmStartSession () returned 0x0 [0205.042] RmRegisterResources () returned 0x0 [0205.047] RmGetList () returned 0x0 [0206.415] RmShutdown () returned 0x0 [0208.418] RmEndSession () returned 0x0 [0208.914] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261188) returned 1 [0208.914] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0208.914] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", dwFileAttributes=0x20) returned 0 [0208.914] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.914] CryptDestroyKey (hKey=0x5261188) returned 1 [0208.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5f80 | out: hHeap=0x310000) returned 1 [0208.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0208.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c088c0 | out: hHeap=0x310000) returned 1 [0208.915] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0208.915] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0208.915] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.915] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0208.932] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.932] ReadFile (in: hFile=0x688, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0208.932] CloseHandle (hObject=0x688) returned 1 [0208.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ed200 [0208.932] RmStartSession () returned 0x0 [0209.298] RmRegisterResources () returned 0x0 [0209.298] RmGetList () returned 0x0 [0209.333] RmShutdown () returned 0x0 [0209.831] RmEndSession () returned 0x0 [0209.831] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261ac8) returned 1 [0209.832] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0209.832] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", dwFileAttributes=0x20) returned 0 [0209.832] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.832] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0209.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ed200 | out: hHeap=0x310000) returned 1 [0209.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc210 | out: hHeap=0x310000) returned 1 [0209.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a55b0 | out: hHeap=0x310000) returned 1 [0209.832] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0209.832] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0209.843] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.843] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0209.847] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.847] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0209.847] CloseHandle (hObject=0x5a8) returned 1 [0209.847] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f8290 [0209.847] RmStartSession () returned 0x0 [0210.376] RmRegisterResources () returned 0x0 [0210.377] RmGetList () returned 0x0 [0212.296] RmShutdown () returned 0x0 [0214.467] RmEndSession () returned 0x0 [0214.771] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261608) returned 1 [0214.771] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0214.772] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", dwFileAttributes=0x20) returned 0 [0214.772] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.772] CryptDestroyKey (hKey=0x5261608) returned 1 [0214.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f8290 | out: hHeap=0x310000) returned 1 [0214.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ec808 | out: hHeap=0x310000) returned 1 [0214.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5920 | out: hHeap=0x310000) returned 1 [0214.772] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0214.772] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec [0214.772] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.772] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0214.857] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.857] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0214.858] CloseHandle (hObject=0x5ec) returned 1 [0214.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd290 [0214.858] RmStartSession () returned 0x0 [0214.859] RmRegisterResources () returned 0x0 [0214.860] RmGetList () returned 0x0 [0215.002] RmShutdown () returned 0x0 [0217.794] RmEndSession () returned 0x0 [0217.871] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260e08) returned 1 [0217.871] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0217.871] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml", dwFileAttributes=0x20) returned 0 [0217.872] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.872] CryptDestroyKey (hKey=0x5260e08) returned 1 [0217.872] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd290 | out: hHeap=0x310000) returned 1 [0217.872] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb600 | out: hHeap=0x310000) returned 1 [0217.872] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6190 | out: hHeap=0x310000) returned 1 [0217.872] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0217.872] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0217.872] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.872] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0217.904] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.904] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0217.904] CloseHandle (hObject=0x5dc) returned 1 [0217.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd290 [0217.904] RmStartSession () returned 0x0 [0217.906] RmRegisterResources () returned 0x0 [0217.906] RmGetList () returned 0x0 [0218.361] RmShutdown () returned 0x0 [0220.784] RmEndSession () returned 0x0 [0220.785] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f88) returned 1 [0220.785] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0220.785] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml", dwFileAttributes=0x20) returned 0 [0220.785] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.785] CryptDestroyKey (hKey=0x5260f88) returned 1 [0220.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd290 | out: hHeap=0x310000) returned 1 [0220.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebd70 | out: hHeap=0x310000) returned 1 [0220.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5e70 | out: hHeap=0x310000) returned 1 [0220.786] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0220.786] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0220.786] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.786] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0220.804] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.805] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0220.805] CloseHandle (hObject=0x5dc) returned 1 [0220.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0220.805] RmStartSession () returned 0x0 [0220.807] RmRegisterResources () returned 0x0 [0221.340] RmGetList () returned 0x0 [0223.889] RmShutdown () returned 0x0 [0224.892] RmEndSession () returned 0x0 [0225.600] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x52610c8) returned 1 [0225.600] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0225.600] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.600] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.600] CryptDestroyKey (hKey=0x52610c8) returned 1 [0225.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0225.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee000 | out: hHeap=0x310000) returned 1 [0225.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14380 | out: hHeap=0x310000) returned 1 [0225.600] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0225.600] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0225.602] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.602] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0225.603] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.603] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0225.603] CloseHandle (hObject=0x5dc) returned 1 [0225.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8c08 [0225.603] RmStartSession () returned 0x0 [0225.630] RmRegisterResources () returned 0x0 [0225.635] RmGetList () returned 0x0 [0226.720] RmShutdown () returned 0x0 [0227.977] RmEndSession () returned 0x0 [0228.448] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x52615c8) returned 1 [0228.448] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0228.448] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm", dwFileAttributes=0x20) returned 0 [0228.449] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.469] CryptDestroyKey (hKey=0x52615c8) returned 1 [0228.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8c08 | out: hHeap=0x310000) returned 1 [0228.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39bf88 | out: hHeap=0x310000) returned 1 [0228.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14560 | out: hHeap=0x310000) returned 1 [0228.469] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0228.469] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0228.470] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.470] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0228.471] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.471] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0228.471] CloseHandle (hObject=0x52c) returned 1 [0228.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8c08 [0228.471] RmStartSession () returned 0x0 [0228.472] RmRegisterResources () returned 0x0 [0228.473] RmGetList () returned 0x0 [0228.672] RmShutdown () returned 0x0 [0230.521] RmEndSession () returned 0x0 [0230.523] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261508) returned 1 [0230.523] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0230.523] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm", dwFileAttributes=0x20) returned 0 [0230.523] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.523] CryptDestroyKey (hKey=0x5261508) returned 1 [0230.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8c08 | out: hHeap=0x310000) returned 1 [0230.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571cc8 | out: hHeap=0x310000) returned 1 [0230.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14fb0 | out: hHeap=0x310000) returned 1 [0230.523] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0230.523] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0230.524] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.524] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0230.525] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.526] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0230.526] CloseHandle (hObject=0x52c) returned 1 [0230.526] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0e28 [0230.526] RmStartSession () returned 0x0 [0231.155] RmRegisterResources () returned 0x0 [0231.749] RmGetList () returned 0x0 [0232.028] RmShutdown () returned 0x0 [0233.482] RmEndSession () returned 0x0 [0233.483] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261688) returned 1 [0233.483] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0233.483] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado60.tlb", dwFileAttributes=0x20) returned 0 [0233.484] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.484] CryptDestroyKey (hKey=0x5261688) returned 1 [0233.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0e28 | out: hHeap=0x310000) returned 1 [0233.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0233.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19150 | out: hHeap=0x310000) returned 1 [0233.484] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0233.484] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0233.484] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.484] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0233.641] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.641] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0233.641] CloseHandle (hObject=0x52c) returned 1 [0233.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0233.641] RmStartSession () returned 0x0 [0233.645] RmRegisterResources () returned 0x0 [0233.645] RmGetList () returned 0x0 [0233.715] RmShutdown () returned 0x0 [0235.731] RmEndSession () returned 0x0 [0236.025] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261888) returned 1 [0236.025] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0236.026] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", dwFileAttributes=0x20) returned 0 [0236.026] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.026] CryptDestroyKey (hKey=0x5261888) returned 1 [0236.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0236.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0236.026] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572ab8 | out: hHeap=0x310000) returned 1 [0236.026] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0236.026] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0236.026] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.026] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0236.031] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.032] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0236.032] CloseHandle (hObject=0x52c) returned 1 [0236.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0236.032] RmStartSession () returned 0x0 [0236.275] RmRegisterResources () returned 0x0 [0236.275] RmGetList () returned 0x0 [0236.373] RmShutdown () returned 0x0 [0236.713] RmEndSession () returned 0x0 [0236.714] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261a48) returned 1 [0236.714] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0236.714] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", dwFileAttributes=0x20) returned 1 [0236.714] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0236.715] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0236.715] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=84355) returned 1 [0236.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54a0e10 [0236.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6591020 [0237.033] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0237.033] ReadFile (in: hFile=0x664, lpBuffer=0x6591040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6591040*, lpNumberOfBytesRead=0x2eef988*=0x14983, lpOverlapped=0x0) returned 1 [0237.036] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0237.036] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.036] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.036] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.036] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.036] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.036] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.037] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.037] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.038] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a0e20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0237.038] WriteFile (in: hFile=0x664, lpBuffer=0x54a0e20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x54a0e20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0237.038] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0237.038] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0237.038] WriteFile (in: hFile=0x664, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0237.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6591020 | out: hHeap=0x310000) returned 1 [0237.364] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54a0e10 | out: hHeap=0x310000) returned 1 [0237.364] CloseHandle (hObject=0x664) returned 1 [0237.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0237.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0237.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0237.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0237.364] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0237.364] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.bdcddcbaad"), dwFlags=0x1) returned 1 [0237.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d199c0 [0237.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391cb0 [0237.365] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.365] SetLastError (dwErrCode=0x0) [0237.365] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] GetLastError () returned 0x0 [0237.366] SetLastError (dwErrCode=0x0) [0237.366] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0237.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0237.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x2eef7c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8kda2ctzsSng7DS", lpUsedDefaultChar=0x0) returned 15 [0237.366] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0237.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0237.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0237.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0237.366] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0237.367] WriteFile (in: hFile=0x664, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe62, lpOverlapped=0x0) returned 1 [0237.368] CloseHandle (hObject=0x664) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391cb0 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d199c0 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0237.368] CryptDestroyKey (hKey=0x5261a48) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39e68 | out: hHeap=0x310000) returned 1 [0237.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572798 | out: hHeap=0x310000) returned 1 [0237.368] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0237.368] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0237.368] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.368] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0237.376] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.376] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0237.376] CloseHandle (hObject=0x664) returned 1 [0237.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a398 [0237.376] RmStartSession () returned 0x0 [0237.378] RmRegisterResources () returned 0x0 [0237.378] RmGetList () returned 0x0 [0237.696] RmShutdown () returned 0x0 [0238.723] RmEndSession () returned 0x0 [0238.724] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261908) returned 1 [0238.724] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0238.724] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf", dwFileAttributes=0x20) returned 1 [0238.725] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0238.725] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0238.725] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=274474) returned 1 [0238.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b60ff0 [0238.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6215020 [0238.743] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0238.743] ReadFile (in: hFile=0x664, lpBuffer=0x6215040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6215040*, lpNumberOfBytesRead=0x2eef988*=0x4302a, lpOverlapped=0x0) returned 1 [0238.749] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.749] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.749] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.749] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.749] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.749] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.749] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.750] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.750] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.751] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.751] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.752] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.752] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0238.753] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0238.753] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0238.754] WriteFile (in: hFile=0x664, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0238.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6215020 | out: hHeap=0x310000) returned 1 [0238.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b60ff0 | out: hHeap=0x310000) returned 1 [0238.758] CloseHandle (hObject=0x664) returned 1 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ab0 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0238.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0238.759] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19e70 [0238.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0238.759] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0238.759] GetLastError () returned 0x0 [0238.759] SetLastError (dwErrCode=0x0) [0238.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.760] SetLastError (dwErrCode=0x0) [0238.760] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b490 [0238.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] GetLastError () returned 0x0 [0238.761] SetLastError (dwErrCode=0x0) [0238.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0238.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0238.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0238.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x38c548, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LUpoh1S64gDKMZE4Tnpz2A", lpUsedDefaultChar=0x0) returned 22 [0238.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0238.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0238.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0238.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0238.761] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0238.762] WriteFile (in: hFile=0x664, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x2eef8fc*=0xe69, lpOverlapped=0x0) returned 1 [0238.763] CloseHandle (hObject=0x664) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ab0 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0238.763] CryptDestroyKey (hKey=0x5261908) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a398 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39850 | out: hHeap=0x310000) returned 1 [0238.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55721a8 | out: hHeap=0x310000) returned 1 [0238.763] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0238.763] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0238.764] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.764] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0239.142] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.142] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0239.142] CloseHandle (hObject=0x664) returned 1 [0239.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0239.142] RmStartSession () returned 0x0 [0239.396] RmRegisterResources () returned 0x0 [0239.396] RmGetList () returned 0x0 [0239.424] RmShutdown () returned 0x0 [0240.287] RmEndSession () returned 0x0 [0240.335] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261188) returned 1 [0240.335] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0240.335] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties", dwFileAttributes=0x20) returned 1 [0240.335] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0240.335] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0240.335] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=6349) returned 1 [0240.335] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0240.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cc020 [0240.963] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0240.964] ReadFile (in: hFile=0x680, lpBuffer=0x65cc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x65cc040*, lpNumberOfBytesRead=0x2eef988*=0x18cd, lpOverlapped=0x0) returned 1 [0240.965] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0240.965] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0240.965] WriteFile (in: hFile=0x680, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0240.965] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0240.965] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0240.966] WriteFile (in: hFile=0x680, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0240.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65cc020 | out: hHeap=0x310000) returned 1 [0240.971] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0240.971] CloseHandle (hObject=0x680) returned 1 [0240.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0240.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbf30 [0240.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0240.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbb98 [0240.971] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0240.971] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0240.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0240.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3918a0 [0240.972] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0240.972] GetLastError () returned 0x0 [0240.972] SetLastError (dwErrCode=0x0) [0240.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0240.972] GetLastError () returned 0x0 [0240.972] SetLastError (dwErrCode=0x0) [0240.972] GetLastError () returned 0x0 [0240.972] SetLastError (dwErrCode=0x0) [0240.972] GetLastError () returned 0x0 [0240.972] SetLastError (dwErrCode=0x0) [0240.972] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b8f0 [0240.973] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0240.973] GetLastError () returned 0x0 [0240.973] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x52e59d0 [0240.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8f0 | out: hHeap=0x310000) returned 1 [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] GetLastError () returned 0x0 [0240.974] SetLastError (dwErrCode=0x0) [0240.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0240.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0240.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0240.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x38c1d8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", lpUsedDefaultChar=0x0) returned 28 [0240.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e59d0 | out: hHeap=0x310000) returned 1 [0240.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0240.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0240.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0240.975] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0240.975] WriteFile (in: hFile=0x680, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6f, lpOverlapped=0x0) returned 1 [0240.976] CloseHandle (hObject=0x680) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3918a0 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0240.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0240.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0240.977] CryptDestroyKey (hKey=0x5261188) returned 1 [0240.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0240.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55700e0 | out: hHeap=0x310000) returned 1 [0240.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55725b8 | out: hHeap=0x310000) returned 1 [0240.977] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0240.977] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0240.977] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.977] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0240.978] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.978] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0240.979] CloseHandle (hObject=0x680) returned 1 [0240.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0240.979] RmStartSession () returned 0x0 [0240.982] RmRegisterResources () returned 0x0 [0240.982] RmGetList () returned 0x0 [0241.384] RmShutdown () returned 0x0 [0241.903] RmEndSession () returned 0x0 [0242.123] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f08) returned 1 [0242.123] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0242.123] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif", dwFileAttributes=0x20) returned 1 [0242.123] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0242.123] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0242.123] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=7805) returned 1 [0242.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0242.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c28020 [0242.141] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0242.141] ReadFile (in: hFile=0x4ac, lpBuffer=0x4c28040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x4c28040*, lpNumberOfBytesRead=0x2eef988*=0x1e7d, lpOverlapped=0x0) returned 1 [0242.263] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0242.263] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0242.263] WriteFile (in: hFile=0x4ac, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0242.263] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0242.264] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0242.264] WriteFile (in: hFile=0x4ac, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0242.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c28020 | out: hHeap=0x310000) returned 1 [0242.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0242.269] CloseHandle (hObject=0x4ac) returned 1 [0242.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0242.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0242.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0242.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0242.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0242.269] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0242.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0242.270] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0242.270] GetLastError () returned 0x0 [0242.270] SetLastError (dwErrCode=0x0) [0242.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0242.270] GetLastError () returned 0x0 [0242.270] SetLastError (dwErrCode=0x0) [0242.270] GetLastError () returned 0x0 [0242.270] SetLastError (dwErrCode=0x0) [0242.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0242.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0242.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x2eef7c0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0242.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0242.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0242.270] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0242.271] WriteFile (in: hFile=0x4ac, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe54, lpOverlapped=0x0) returned 1 [0242.272] CloseHandle (hObject=0x4ac) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0242.272] CryptDestroyKey (hKey=0x5260f08) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570e88 | out: hHeap=0x310000) returned 1 [0242.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352970 | out: hHeap=0x310000) returned 1 [0242.272] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0242.272] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0242.273] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.273] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0242.306] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.306] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0242.306] CloseHandle (hObject=0x4ac) returned 1 [0242.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0242.306] RmStartSession () returned 0x0 [0242.505] RmRegisterResources () returned 0x0 [0242.506] RmGetList () returned 0x0 [0242.660] RmShutdown () returned 0x0 [0243.644] RmEndSession () returned 0x0 [0243.645] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261448) returned 1 [0243.645] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0243.645] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar", dwFileAttributes=0x20) returned 1 [0243.645] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0243.645] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0243.645] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=2204781) returned 1 [0243.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0243.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c0020 [0243.664] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0243.664] ReadFile (in: hFile=0x4ac, lpBuffer=0x65c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x65c0040*, lpNumberOfBytesRead=0x2eef988*=0x100000, lpOverlapped=0x0) returned 1 [0244.017] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0244.017] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.017] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.017] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.018] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.027] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.027] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.027] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.027] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.029] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.029] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.030] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.031] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.032] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.032] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.033] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.033] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.034] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.034] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.035] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.035] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.036] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.036] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.037] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.038] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.038] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.039] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.040] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.040] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.041] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.042] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.043] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.044] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.045] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.045] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.046] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.046] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.046] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0244.046] ReadFile (in: hFile=0x4ac, lpBuffer=0x65c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x65c0040*, lpNumberOfBytesRead=0x2eef988*=0x100000, lpOverlapped=0x0) returned 1 [0244.485] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.485] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.486] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.487] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.488] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.488] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.489] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.489] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.490] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.490] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.491] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.491] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.492] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.493] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.494] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.495] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.496] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.496] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.497] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.497] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.498] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.499] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.500] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.500] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.501] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.501] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.501] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.501] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0244.501] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6e080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0244.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d6e080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5d6e080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0245.483] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0245.483] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] SetLastError (dwErrCode=0x0) [0245.484] GetLastError () returned 0x0 [0245.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0245.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x2eef7c0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0245.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0245.484] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0245.484] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0245.484] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0245.485] WriteFile (in: hFile=0x4ac, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2eef8fc*=0xe5c, lpOverlapped=0x0) returned 1 [0245.486] CloseHandle (hObject=0x4ac) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0245.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0245.487] CryptDestroyKey (hKey=0x5261448) returned 1 [0245.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0245.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a32b8 | out: hHeap=0x310000) returned 1 [0245.487] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352920 | out: hHeap=0x310000) returned 1 [0245.487] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0245.487] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0245.487] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.487] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0245.489] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.489] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0245.489] CloseHandle (hObject=0x4ac) returned 1 [0245.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0245.489] RmStartSession () returned 0x0 [0245.491] RmRegisterResources () returned 0x0 [0245.492] RmGetList () returned 0x0 [0246.142] RmShutdown () [0248.313] RmEndSession () returned 0x0 [0248.651] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261388) returned 1 [0248.651] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0248.651] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf", dwFileAttributes=0x20) returned 1 [0248.651] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.651] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0248.651] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=317896) returned 1 [0248.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0248.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf1020 [0248.772] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0248.772] GetLastError () returned 0x0 [0248.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0248.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0248.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0248.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0248.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0248.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0248.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0248.773] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.774] WriteFile (in: hFile=0x668, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe69, lpOverlapped=0x0) returned 1 [0248.774] CloseHandle (hObject=0x668) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0248.775] CryptDestroyKey (hKey=0x5261388) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570d58 | out: hHeap=0x310000) returned 1 [0248.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352240 | out: hHeap=0x310000) returned 1 [0248.775] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0248.775] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.776] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.777] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0248.840] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.840] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0248.840] CloseHandle (hObject=0x668) returned 1 [0248.841] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0248.841] RmStartSession () returned 0x0 [0249.159] RmRegisterResources () returned 0x0 [0249.163] RmGetList () returned 0x0 [0249.441] RmShutdown () returned 0x0 [0250.003] RmEndSession () returned 0x0 [0250.004] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261988) returned 1 [0250.004] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0250.004] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", dwFileAttributes=0x20) returned 1 [0250.004] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0250.004] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0250.005] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=944167) returned 1 [0250.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0250.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58d2020 [0250.528] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0250.528] GetLastError () returned 0x0 [0250.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0250.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0250.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x38c520, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mq0Gric0JR23PHFSN5QG4V5474", lpUsedDefaultChar=0x0) returned 26 [0250.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ed790 | out: hHeap=0x310000) returned 1 [0250.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0250.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0250.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0250.528] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0250.529] WriteFile (in: hFile=0x668, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6d, lpOverlapped=0x0) returned 1 [0250.530] CloseHandle (hObject=0x668) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391e50 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0250.530] CryptDestroyKey (hKey=0x5261988) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39ee0 | out: hHeap=0x310000) returned 1 [0250.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53534b0 | out: hHeap=0x310000) returned 1 [0250.530] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0250.530] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0250.531] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.531] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0250.557] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.557] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0250.557] CloseHandle (hObject=0x668) returned 1 [0250.557] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0250.557] RmStartSession () returned 0x0 [0250.559] RmRegisterResources () returned 0x0 [0250.563] RmGetList () returned 0x0 [0251.597] RmShutdown () returned 0x0 [0257.418] RmEndSession () returned 0x0 [0257.419] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261388) returned 1 [0257.419] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0257.419] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template", dwFileAttributes=0x20) returned 1 [0257.420] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0257.420] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0257.420] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=2856) returned 1 [0257.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54b7e48 [0257.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3e020 [0258.136] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0258.136] GetLastError () returned 0x0 [0258.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0258.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x38c070, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Jqd1nQTWMi6MgqEEJIg", lpUsedDefaultChar=0x0) returned 20 [0258.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0258.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0258.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0258.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0258.137] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0258.138] WriteFile (in: hFile=0x668, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe67, lpOverlapped=0x0) returned 1 [0258.138] CloseHandle (hObject=0x668) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19df8 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9b90 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0258.139] CryptDestroyKey (hKey=0x5261388) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef3b0 | out: hHeap=0x310000) returned 1 [0258.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352d30 | out: hHeap=0x310000) returned 1 [0258.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0258.139] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0258.139] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.139] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0258.141] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.141] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0258.141] CloseHandle (hObject=0x668) returned 1 [0258.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09da8 [0258.141] RmStartSession () returned 0x0 [0258.144] RmRegisterResources () returned 0x0 [0258.144] RmGetList () returned 0x0 [0259.140] RmShutdown () returned 0x0 [0259.773] RmEndSession () returned 0x0 [0259.774] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261508) returned 1 [0259.774] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0259.775] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0259.775] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0259.775] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0259.775] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=1261) returned 1 [0259.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c89228 [0259.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c26020 [0260.713] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0260.713] GetLastError () returned 0x0 [0260.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0260.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0260.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c390, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0260.714] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61193b0 | out: hHeap=0x310000) returned 1 [0260.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0260.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0260.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0260.714] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0260.715] WriteFile (in: hFile=0x668, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x2eef8fc*=0xe71, lpOverlapped=0x0) returned 1 [0260.715] CloseHandle (hObject=0x668) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f045c0 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f728 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0adf8 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0260.716] CryptDestroyKey (hKey=0x5261508) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09da8 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9e58 | out: hHeap=0x310000) returned 1 [0260.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352060 | out: hHeap=0x310000) returned 1 [0260.716] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0260.716] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0260.716] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.716] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0260.718] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.718] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0260.718] CloseHandle (hObject=0x668) returned 1 [0260.718] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09da8 [0260.718] RmStartSession () returned 0x0 [0261.086] RmRegisterResources () returned 0x0 [0261.086] RmGetList () returned 0x0 [0261.321] RmShutdown () returned 0x0 [0262.892] RmEndSession () returned 0x0 [0262.955] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5260f88) returned 1 [0262.955] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0262.955] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0262.955] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0262.956] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0262.956] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=2147) returned 1 [0262.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c72020 [0262.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589e020 [0263.004] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0263.004] GetLastError () returned 0x0 [0263.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0263.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x2eef7c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0263.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0263.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0263.005] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0263.006] WriteFile (in: hFile=0x5b0, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2eef8fc*=0xe57, lpOverlapped=0x0) returned 1 [0263.007] CloseHandle (hObject=0x5b0) returned 1 [0263.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0263.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0263.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0263.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04220 | out: hHeap=0x310000) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a06a8 | out: hHeap=0x310000) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f044d8 | out: hHeap=0x310000) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0263.008] CryptDestroyKey (hKey=0x5260f88) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09da8 | out: hHeap=0x310000) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9d70 | out: hHeap=0x310000) returned 1 [0263.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351f70 | out: hHeap=0x310000) returned 1 [0263.008] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0263.008] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0263.008] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0263.008] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0263.032] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0263.032] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0263.032] CloseHandle (hObject=0x5b0) returned 1 [0263.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f04de8 [0263.032] RmStartSession () returned 0x0 [0263.849] RmRegisterResources () returned 0x0 [0263.850] RmGetList () returned 0x0 [0263.886] RmShutdown () returned 0x0 [0266.205] RmEndSession () returned 0x0 [0266.206] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261648) returned 1 [0266.206] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0266.206] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0266.206] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0266.206] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0266.206] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=1450) returned 1 [0266.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0266.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7c09020 [0267.133] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0267.133] GetLastError () returned 0x0 [0267.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0267.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0267.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x38c390, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pvosW60j6t7if2aYH", lpUsedDefaultChar=0x0) returned 17 [0267.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b848 | out: hHeap=0x310000) returned 1 [0267.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0267.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0267.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0267.134] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0267.135] WriteFile (in: hFile=0x5b0, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe64, lpOverlapped=0x0) returned 1 [0267.136] CloseHandle (hObject=0x5b0) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539c1e0 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0267.136] CryptDestroyKey (hKey=0x5261648) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04de8 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348b78 | out: hHeap=0x310000) returned 1 [0267.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c195b0 | out: hHeap=0x310000) returned 1 [0267.136] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0267.136] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0267.136] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.136] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0267.146] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.146] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0267.146] CloseHandle (hObject=0x5b0) returned 1 [0267.146] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0267.147] RmStartSession () returned 0x0 [0267.148] RmRegisterResources () returned 0x0 [0267.149] RmGetList () returned 0x0 [0267.192] RmShutdown () returned 0x0 [0268.086] RmEndSession () returned 0x0 [0268.087] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261508) returned 1 [0268.087] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0268.087] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF", dwFileAttributes=0x220) returned 1 [0268.087] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0268.088] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0268.088] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=14873) returned 1 [0268.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0268.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b5020 [0269.220] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0269.220] GetLastError () returned 0x0 [0269.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0269.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0269.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x38c520, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1f15BUaqm7XqtONc8btxaBe3", lpUsedDefaultChar=0x0) returned 24 [0269.220] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89320 | out: hHeap=0x310000) returned 1 [0269.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0269.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0269.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0269.220] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0269.221] WriteFile (in: hFile=0x5b0, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6b, lpOverlapped=0x0) returned 1 [0269.222] CloseHandle (hObject=0x5b0) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0269.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0269.223] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0269.223] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0269.223] CryptDestroyKey (hKey=0x5261508) returned 1 [0269.223] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0269.223] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55706d0 | out: hHeap=0x310000) returned 1 [0269.223] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5bc0 | out: hHeap=0x310000) returned 1 [0269.223] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0269.223] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0269.223] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.223] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0269.233] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.233] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0269.233] CloseHandle (hObject=0x5b0) returned 1 [0269.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0269.233] RmStartSession () returned 0x0 [0269.235] RmRegisterResources () returned 0x0 [0269.235] RmGetList () returned 0x0 [0269.390] RmShutdown () returned 0x0 [0269.427] RmEndSession () returned 0x0 [0269.428] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261688) returned 1 [0269.428] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0269.428] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF", dwFileAttributes=0x220) returned 1 [0269.428] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0269.428] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0269.428] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=2596) returned 1 [0269.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0269.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b8020 [0269.966] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0269.966] GetLastError () returned 0x0 [0269.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0269.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0269.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c4d0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0269.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89960 | out: hHeap=0x310000) returned 1 [0269.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0269.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0269.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0269.967] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0269.968] WriteFile (in: hFile=0x5b0, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6e, lpOverlapped=0x0) returned 1 [0269.969] CloseHandle (hObject=0x5b0) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0269.969] CryptDestroyKey (hKey=0x5261688) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4d18 | out: hHeap=0x310000) returned 1 [0269.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e34f0 | out: hHeap=0x310000) returned 1 [0269.969] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0269.969] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0269.989] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.989] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0269.994] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.994] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0269.994] CloseHandle (hObject=0x5b0) returned 1 [0269.994] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0269.994] RmStartSession () returned 0x0 [0269.996] RmRegisterResources () returned 0x0 [0269.997] RmGetList () returned 0x0 [0271.109] RmShutdown () returned 0x0 [0271.593] RmEndSession () returned 0x0 [0271.594] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261748) returned 1 [0271.594] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0271.594] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF", dwFileAttributes=0x220) returned 1 [0271.594] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0271.594] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0271.594] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=4955) returned 1 [0271.594] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0271.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cfb020 [0271.997] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0271.997] GetLastError () returned 0x0 [0271.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0271.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x2eef7c0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bY", lpUsedDefaultChar=0x0) returned 2 [0271.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0271.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0271.998] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0271.999] WriteFile (in: hFile=0x5b0, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x2eef8fc*=0xe55, lpOverlapped=0x0) returned 1 [0271.999] CloseHandle (hObject=0x5b0) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc9f8 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0272.000] CryptDestroyKey (hKey=0x5261748) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5a28 | out: hHeap=0x310000) returned 1 [0272.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3450 | out: hHeap=0x310000) returned 1 [0272.000] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0272.000] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0272.000] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.000] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0272.019] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.019] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0272.019] CloseHandle (hObject=0x5b0) returned 1 [0272.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0272.019] RmStartSession () returned 0x0 [0272.023] RmRegisterResources () returned 0x0 [0272.024] RmGetList () returned 0x0 [0272.062] RmShutdown () returned 0x0 [0274.649] RmEndSession () returned 0x0 [0274.650] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261408) returned 1 [0274.650] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0274.650] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF", dwFileAttributes=0x220) returned 1 [0274.651] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0274.651] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0274.651] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=5016) returned 1 [0274.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0274.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58d0020 [0275.000] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0275.000] GetLastError () returned 0x0 [0275.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x2eef7c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0275.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0275.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.001] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0275.002] WriteFile (in: hFile=0x5b0, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe5e, lpOverlapped=0x0) returned 1 [0275.002] CloseHandle (hObject=0x5b0) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cede38 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0275.003] CryptDestroyKey (hKey=0x5261408) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0275.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3090 | out: hHeap=0x310000) returned 1 [0275.003] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0275.003] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0275.003] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.003] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0275.017] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.017] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0275.017] CloseHandle (hObject=0x5b0) returned 1 [0275.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0275.017] RmStartSession () returned 0x0 [0275.019] RmRegisterResources () returned 0x0 [0275.020] RmGetList () returned 0x0 [0275.043] RmShutdown () returned 0x0 [0275.465] RmEndSession () returned 0x0 [0275.639] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261748) returned 1 [0275.640] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0275.640] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF", dwFileAttributes=0x220) returned 1 [0275.640] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0275.640] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0275.640] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=3344) returned 1 [0275.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0275.640] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6214020 [0275.664] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0275.664] GetLastError () returned 0x0 [0275.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x2eef7c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.664] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0275.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0275.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.664] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0275.665] WriteFile (in: hFile=0x5b0, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x2eef8fc*=0xe5e, lpOverlapped=0x0) returned 1 [0275.666] CloseHandle (hObject=0x5b0) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ced200 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0275.666] CryptDestroyKey (hKey=0x5261748) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a61e0 | out: hHeap=0x310000) returned 1 [0275.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3770 | out: hHeap=0x310000) returned 1 [0275.667] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0275.667] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0275.667] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.667] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0275.707] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.707] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0275.707] CloseHandle (hObject=0x5b0) returned 1 [0275.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0275.707] RmStartSession () returned 0x0 [0275.709] RmRegisterResources () returned 0x0 [0275.710] RmGetList () returned 0x0 [0276.656] RmShutdown () returned 0x0 [0277.567] RmEndSession () returned 0x0 [0277.568] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261488) returned 1 [0277.568] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0277.568] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF", dwFileAttributes=0x220) returned 1 [0277.568] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0277.568] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0277.568] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=27858) returned 1 [0277.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0277.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b3020 [0278.198] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0278.198] ReadFile (in: hFile=0x5b0, lpBuffer=0x64b3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x64b3040*, lpNumberOfBytesRead=0x2eef988*=0x6cd2, lpOverlapped=0x0) returned 1 [0278.200] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0278.200] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0278.200] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0278.200] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0278.200] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0278.200] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0278.200] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0278.200] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0278.200] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0278.200] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0278.200] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0278.201] WriteFile (in: hFile=0x5b0, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0278.201] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b3020 | out: hHeap=0x310000) returned 1 [0278.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0278.921] CloseHandle (hObject=0x5b0) returned 1 [0278.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0278.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0278.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0278.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0278.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0278.922] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0278.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0278.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0278.923] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0278.923] GetLastError () returned 0x0 [0278.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0278.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0278.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x38c0c0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5PaBVzxQBGd15AjyqsacvL0n", lpUsedDefaultChar=0x0) returned 24 [0278.924] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7b9a0 | out: hHeap=0x310000) returned 1 [0278.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0278.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0278.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0278.924] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0278.925] WriteFile (in: hFile=0x5b0, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6b, lpOverlapped=0x0) returned 1 [0278.926] CloseHandle (hObject=0x5b0) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0278.926] CryptDestroyKey (hKey=0x5261488) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a67d0 | out: hHeap=0x310000) returned 1 [0278.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1f60 | out: hHeap=0x310000) returned 1 [0278.926] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0278.926] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0278.927] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.927] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0278.953] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.953] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0278.953] CloseHandle (hObject=0x5b0) returned 1 [0278.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0278.953] RmStartSession () returned 0x0 [0278.954] RmRegisterResources () returned 0x0 [0278.955] RmGetList () returned 0x0 [0279.010] RmShutdown () returned 0x0 [0281.111] RmEndSession () returned 0x0 [0281.111] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x35da08) returned 1 [0281.112] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0281.112] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF", dwFileAttributes=0x220) returned 1 [0281.112] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0281.112] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0281.112] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=3144) returned 1 [0281.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0281.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f6020 [0281.792] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0281.792] ReadFile (in: hFile=0x5b0, lpBuffer=0x76f6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x76f6040*, lpNumberOfBytesRead=0x2eef988*=0xc48, lpOverlapped=0x0) returned 1 [0281.793] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0281.793] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0281.793] WriteFile (in: hFile=0x5b0, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0281.793] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0281.793] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0281.793] WriteFile (in: hFile=0x5b0, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0281.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f6020 | out: hHeap=0x310000) returned 1 [0282.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0282.641] CloseHandle (hObject=0x5b0) returned 1 [0282.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0282.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0282.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4c80 [0282.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0282.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0282.642] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0282.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4db0 [0282.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0282.643] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0282.643] GetLastError () returned 0x0 [0282.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0282.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x2eef7c0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fl", lpUsedDefaultChar=0x0) returned 2 [0282.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0282.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0282.643] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0282.644] WriteFile (in: hFile=0x5b0, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x2eef8fc*=0xe55, lpOverlapped=0x0) returned 1 [0282.645] CloseHandle (hObject=0x5b0) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4db0 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4c80 | out: hHeap=0x310000) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0282.645] CryptDestroyKey (hKey=0x35da08) returned 1 [0282.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0282.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94af8 | out: hHeap=0x310000) returned 1 [0282.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1c90 | out: hHeap=0x310000) returned 1 [0282.646] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0282.646] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0282.646] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.646] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0282.683] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.683] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0282.684] CloseHandle (hObject=0x5b0) returned 1 [0282.684] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4120 [0282.684] RmStartSession () returned 0x0 [0282.686] RmRegisterResources () returned 0x0 [0282.690] RmGetList () returned 0x0 [0283.403] RmShutdown () returned 0x0 [0284.825] RmEndSession () returned 0x0 [0284.826] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x52611c8) returned 1 [0284.826] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0284.826] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x220) returned 1 [0284.826] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0284.826] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0284.826] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=16180) returned 1 [0284.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0284.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6586020 [0284.856] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0284.856] ReadFile (in: hFile=0x5b0, lpBuffer=0x6586040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6586040*, lpNumberOfBytesRead=0x2eef988*=0x3f34, lpOverlapped=0x0) returned 1 [0284.858] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0284.858] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0284.858] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0284.858] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0284.858] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0284.858] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0284.858] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0284.859] WriteFile (in: hFile=0x5b0, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0284.859] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6586020 | out: hHeap=0x310000) returned 1 [0284.864] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0284.864] CloseHandle (hObject=0x5b0) returned 1 [0284.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0284.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0284.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4728 [0284.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0284.864] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0284.864] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0284.865] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4690 [0284.865] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0284.865] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0284.865] GetLastError () returned 0x0 [0284.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0284.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x2eef7c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0284.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0284.865] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0284.865] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0284.865] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0284.866] WriteFile (in: hFile=0x5b0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe5f, lpOverlapped=0x0) returned 1 [0284.867] CloseHandle (hObject=0x5b0) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4690 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4728 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0284.867] CryptDestroyKey (hKey=0x52611c8) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4120 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95218 | out: hHeap=0x310000) returned 1 [0284.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2550 | out: hHeap=0x310000) returned 1 [0284.867] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0284.867] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0284.868] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.868] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0285.129] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.129] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0285.129] CloseHandle (hObject=0x5b0) returned 1 [0285.129] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0285.129] RmStartSession () returned 0x0 [0285.263] RmRegisterResources () returned 0x0 [0285.263] RmGetList () returned 0x0 [0285.335] RmShutdown () returned 0x0 [0285.371] RmEndSession () returned 0x0 [0285.372] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261308) returned 1 [0285.372] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0285.372] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x220) returned 1 [0285.372] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0285.373] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0285.373] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=24320) returned 1 [0285.373] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c6d010 [0285.373] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6588020 [0285.828] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0285.828] ReadFile (in: hFile=0x5b0, lpBuffer=0x6588040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x6588040*, lpNumberOfBytesRead=0x2eef988*=0x5f00, lpOverlapped=0x0) returned 1 [0286.078] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0286.078] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0286.078] WriteFile (in: hFile=0x5b0, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0286.079] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0286.079] WriteFile (in: hFile=0x5b0, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0286.079] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0286.079] WriteFile (in: hFile=0x5b0, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0286.079] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0286.079] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0286.079] WriteFile (in: hFile=0x5b0, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0286.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6588020 | out: hHeap=0x310000) returned 1 [0286.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c6d010 | out: hHeap=0x310000) returned 1 [0286.084] CloseHandle (hObject=0x5b0) returned 1 [0286.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0286.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c16e8 [0286.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0286.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0286.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c16e8 | out: hHeap=0x310000) returned 1 [0286.085] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0286.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0286.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0286.086] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0286.086] GetLastError () returned 0x0 [0286.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0286.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x2eef7c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aGphKsS54ZcVf9i", lpUsedDefaultChar=0x0) returned 15 [0286.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0286.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0286.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0286.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0286.086] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0286.087] WriteFile (in: hFile=0x5b0, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe62, lpOverlapped=0x0) returned 1 [0286.088] CloseHandle (hObject=0x5b0) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0286.088] CryptDestroyKey (hKey=0x5261308) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94e88 | out: hHeap=0x310000) returned 1 [0286.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2aa0 | out: hHeap=0x310000) returned 1 [0286.088] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0286.088] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0286.089] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.089] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0286.142] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.142] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0286.142] CloseHandle (hObject=0x5b0) returned 1 [0286.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0286.142] RmStartSession () returned 0x0 [0286.145] RmRegisterResources () returned 0x0 [0286.146] RmGetList () returned 0x0 [0286.297] RmShutdown () returned 0x0 [0289.920] RmEndSession () returned 0x0 [0290.119] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261648) returned 1 [0290.119] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0290.119] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF", dwFileAttributes=0x220) returned 1 [0290.120] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0290.120] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0290.120] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=20554) returned 1 [0290.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0290.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5627020 [0290.139] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0290.139] ReadFile (in: hFile=0x5b0, lpBuffer=0x5627040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x5627040*, lpNumberOfBytesRead=0x2eef988*=0x504a, lpOverlapped=0x0) returned 1 [0290.165] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0290.165] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0290.165] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0290.165] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0290.165] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0290.165] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0290.167] WriteFile (in: hFile=0x5b0, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0290.167] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0290.167] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0290.167] WriteFile (in: hFile=0x5b0, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0290.167] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5627020 | out: hHeap=0x310000) returned 1 [0290.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0290.172] CloseHandle (hObject=0x5b0) returned 1 [0290.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0290.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0290.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4e48 [0290.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0290.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0290.173] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.173] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0290.173] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0290.173] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0290.174] GetLastError () returned 0x0 [0290.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0290.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0290.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c1d8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0290.174] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603eb40 | out: hHeap=0x310000) returned 1 [0290.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0290.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0290.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x515cc58 [0290.174] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0290.175] WriteFile (in: hFile=0x5b0, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6f, lpOverlapped=0x0) returned 1 [0290.176] CloseHandle (hObject=0x5b0) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x515cc58 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4e48 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0290.176] CryptDestroyKey (hKey=0x5261648) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95e90 | out: hHeap=0x310000) returned 1 [0290.176] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2500 | out: hHeap=0x310000) returned 1 [0290.176] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0290.176] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0290.177] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.177] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0290.582] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.583] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0290.583] CloseHandle (hObject=0x5b0) returned 1 [0290.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5860 [0290.583] RmStartSession () returned 0x0 [0290.917] RmRegisterResources () returned 0x0 [0290.918] RmGetList () returned 0x0 [0291.094] RmShutdown () returned 0x0 [0293.105] RmEndSession () returned 0x0 [0293.185] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x35d708) returned 1 [0293.185] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0293.185] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF", dwFileAttributes=0x220) returned 1 [0293.186] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0293.186] CryptEncrypt (in: hKey=0x35d708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0293.186] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=1516) returned 1 [0293.186] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0293.186] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf6020 [0293.205] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0293.205] ReadFile (in: hFile=0x640, lpBuffer=0x4cf6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x4cf6040*, lpNumberOfBytesRead=0x2eef988*=0x5ec, lpOverlapped=0x0) returned 1 [0293.205] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0293.205] CryptEncrypt (in: hKey=0x35d708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0293.205] WriteFile (in: hFile=0x640, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0293.206] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0293.206] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0293.206] WriteFile (in: hFile=0x640, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0293.206] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf6020 | out: hHeap=0x310000) returned 1 [0293.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0293.211] CloseHandle (hObject=0x640) returned 1 [0293.212] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0293.212] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5f80 [0293.212] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5438 [0293.212] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c6038 [0293.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5f80 | out: hHeap=0x310000) returned 1 [0293.212] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0293.213] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0293.213] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb9b8 [0293.213] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0293.213] GetLastError () returned 0x0 [0293.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0293.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x2eef7c0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0293.213] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0293.213] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0293.213] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0293.214] WriteFile (in: hFile=0x640, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe59, lpOverlapped=0x0) returned 1 [0293.215] CloseHandle (hObject=0x640) returned 1 [0293.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0293.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0293.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb9b8 | out: hHeap=0x310000) returned 1 [0293.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0293.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c6038 | out: hHeap=0x310000) returned 1 [0293.216] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5438 | out: hHeap=0x310000) returned 1 [0293.216] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0293.216] CryptDestroyKey (hKey=0x35d708) returned 1 [0293.216] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5860 | out: hHeap=0x310000) returned 1 [0293.216] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306910 | out: hHeap=0x310000) returned 1 [0293.216] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a088 | out: hHeap=0x310000) returned 1 [0293.216] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0293.216] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0293.216] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.216] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0293.545] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.545] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0293.545] CloseHandle (hObject=0x640) returned 1 [0293.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6310 [0293.545] RmStartSession () returned 0x0 [0293.708] RmRegisterResources () returned 0x0 [0293.709] RmGetList () returned 0x0 [0294.105] RmShutdown () [0297.391] RmEndSession () returned 0x0 [0297.392] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261448) returned 1 [0297.392] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0297.392] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF", dwFileAttributes=0x220) returned 1 [0297.392] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0297.392] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0297.392] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=27050) returned 1 [0297.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0297.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f7020 [0297.582] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0297.582] ReadFile (in: hFile=0x6a8, lpBuffer=0x76f7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x76f7040*, lpNumberOfBytesRead=0x2eef988*=0x69aa, lpOverlapped=0x0) returned 1 [0297.588] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0297.588] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0297.588] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0297.591] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0297.591] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0297.591] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0297.591] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0297.591] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0297.591] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0297.591] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0297.592] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0297.592] WriteFile (in: hFile=0x6a8, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0297.592] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f7020 | out: hHeap=0x310000) returned 1 [0297.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0297.685] CloseHandle (hObject=0x6a8) returned 1 [0297.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0297.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6071538 [0297.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94340 [0297.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6070900 [0297.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6071538 | out: hHeap=0x310000) returned 1 [0297.685] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0297.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94d58 [0297.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0297.687] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0297.687] GetLastError () returned 0x0 [0297.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VczdUZcTKKQEDrj6wrc", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0297.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0297.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VczdUZcTKKQEDrj6wrc", cchWideChar=19, lpMultiByteStr=0x38c188, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VczdUZcTKKQEDrj6wrc", lpUsedDefaultChar=0x0) returned 19 [0297.687] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0297.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0297.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0297.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0297.687] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0297.688] WriteFile (in: hFile=0x6a8, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe66, lpOverlapped=0x0) returned 1 [0297.689] CloseHandle (hObject=0x6a8) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94d58 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6070900 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94340 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0297.689] CryptDestroyKey (hKey=0x5261448) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6310 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306e68 | out: hHeap=0x310000) returned 1 [0297.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609ae8 | out: hHeap=0x310000) returned 1 [0297.690] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0297.690] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0297.690] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0297.690] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0297.746] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0297.746] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0297.746] CloseHandle (hObject=0x6a8) returned 1 [0297.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c942a8 [0297.747] RmStartSession () returned 0x0 [0297.750] RmRegisterResources () returned 0x0 [0297.756] RmGetList () returned 0x0 [0298.257] RmShutdown () returned 0x0 [0298.769] RmEndSession () returned 0x0 [0298.770] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x2eefa88 | out: phKey=0x2eefa88*=0x5261848) returned 1 [0298.770] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0298.770] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x220) returned 1 [0298.770] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0298.770] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x2eef8e8*=0x2000) returned 1 [0298.770] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2eef980 | out: lpFileSize=0x2eef980*=7974) returned 1 [0298.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0298.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x780a020 [0298.855] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0298.855] ReadFile (in: hFile=0x6a8, lpBuffer=0x780a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2eef988, lpOverlapped=0x0 | out: lpBuffer=0x780a040*, lpNumberOfBytesRead=0x2eef988*=0x1f26, lpOverlapped=0x0) returned 1 [0298.867] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef970 | out: lpNewFilePointer=0x0) returned 1 [0298.867] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x2eef8fc*=0x2000) returned 1 [0298.867] WriteFile (in: hFile=0x6a8, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x2eef98c*=0x2000, lpOverlapped=0x0) returned 1 [0298.867] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eef978 | out: lpNewFilePointer=0x0) returned 1 [0298.868] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x2eef98c*=0x200, lpOverlapped=0x0) returned 1 [0298.868] WriteFile (in: hFile=0x6a8, lpBuffer=0x2eef928*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x2eef928*, lpNumberOfBytesWritten=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0298.868] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x780a020 | out: hHeap=0x310000) returned 1 [0298.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0298.873] CloseHandle (hObject=0x6a8) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0298.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606e3a0 [0298.874] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95640 [0298.874] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606e230 [0298.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606e3a0 | out: hHeap=0x310000) returned 1 [0298.874] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c959d0 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0298.875] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x2eef75c | out: lpSystemTimeAsFileTime=0x2eef75c) [0298.875] GetLastError () returned 0x0 [0298.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EMCq9yia0YqsRhVfnvRQ8CimLg", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0298.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EMCq9yia0YqsRhVfnvRQ8CimLg", cchWideChar=26, lpMultiByteStr=0x38c188, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EMCq9yia0YqsRhVfnvRQ8CimLg", lpUsedDefaultChar=0x0) returned 26 [0298.875] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dccbf0 | out: hHeap=0x310000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0298.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0298.875] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0298.876] WriteFile (in: hFile=0x6a8, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x2eef8fc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x2eef8fc*=0xe6d, lpOverlapped=0x0) returned 1 [0298.877] CloseHandle (hObject=0x6a8) returned 1 [0298.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0298.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0298.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0298.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0298.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606e230 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95640 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0298.878] CryptDestroyKey (hKey=0x5261848) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c942a8 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5305870 | out: hHeap=0x310000) returned 1 [0298.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560ab78 | out: hHeap=0x310000) returned 1 [0298.878] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x2eefabc, lpCompletionKey=0x2eefac0, lpOverlapped=0x2eefab8) returned 1 [0298.878] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0298.878] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef990 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.878] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef98c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef98c*=0x18, lpOverlapped=0x0) returned 1 [0299.086] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eef998 | out: lpNewFilePointer=0xffffffff) returned 1 [0299.086] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2eef980, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x2eef980*=0x18, lpOverlapped=0x0) returned 1 [0299.086] CloseHandle (hObject=0x6a8) returned 1 [0299.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94638 [0299.086] RmStartSession () returned 0x0 [0299.168] RmRegisterResources () returned 0x0 [0299.172] RmGetList () Thread: id = 6 os_tid = 0xa24 [0068.585] GetLastError () returned 0x57 [0068.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x347820 [0068.585] SetLastError (dwErrCode=0x57) [0068.585] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0070.882] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0086.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0091.083] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0093.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0103.173] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0129.881] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0135.270] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ac [0135.272] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.272] ReadFile (in: hFile=0x5ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0135.276] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.276] ReadFile (in: hFile=0x5ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0135.276] CloseHandle (hObject=0x5ac) returned 1 [0135.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0135.276] RmStartSession () returned 0x0 [0136.032] RmRegisterResources () returned 0x0 [0136.036] RmGetList () returned 0x0 [0137.554] RmShutdown () returned 0x0 [0139.719] RmEndSession () returned 0x0 [0139.720] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x35d788) returned 1 [0139.720] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0139.720] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.720] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0139.720] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0139.720] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=7567) returned 1 [0139.720] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5609bf8 [0139.721] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2f020 [0139.963] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0139.963] ReadFile (in: hFile=0x5c0, lpBuffer=0x4c2f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x4c2f040*, lpNumberOfBytesRead=0x302f694*=0x1d8f, lpOverlapped=0x0) returned 1 [0139.974] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0139.974] CryptEncrypt (in: hKey=0x35d788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5609c00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5609c00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0139.974] WriteFile (in: hFile=0x5c0, lpBuffer=0x5609c00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5609c00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0139.974] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0139.974] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0139.974] WriteFile (in: hFile=0x5c0, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0139.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c2f020 | out: hHeap=0x310000) returned 1 [0140.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609bf8 | out: hHeap=0x310000) returned 1 [0140.100] CloseHandle (hObject=0x5c0) returned 1 [0140.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0140.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0140.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0140.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0140.101] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0140.101] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1025\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0140.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0140.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0140.139] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.139] SetLastError (dwErrCode=0x0) [0140.139] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c228 [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0140.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c228 | out: hHeap=0x310000) returned 1 [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] GetLastError () returned 0x0 [0140.140] SetLastError (dwErrCode=0x0) [0140.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0140.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bJplnm0dKLtbPH3bwe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0140.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0140.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bJplnm0dKLtbPH3bwe", cchWideChar=18, lpMultiByteStr=0x38c548, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bJplnm0dKLtbPH3bwe", lpUsedDefaultChar=0x0) returned 18 [0140.141] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0140.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0140.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5061058 [0140.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0140.141] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0140.141] WriteFile (in: hFile=0x5c0, lpBuffer=0x5061058*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x5061058*, lpNumberOfBytesWritten=0x302f608*=0xe65, lpOverlapped=0x0) returned 1 [0140.142] CloseHandle (hObject=0x5c0) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5061058 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0140.143] CryptDestroyKey (hKey=0x35d788) returned 1 [0140.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0140.144] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0140.144] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3655e8 | out: hHeap=0x310000) returned 1 [0140.144] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0140.144] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0140.144] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.144] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0140.150] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.150] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0140.150] CloseHandle (hObject=0x5c0) returned 1 [0140.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0140.150] RmStartSession () returned 0x0 [0140.153] RmRegisterResources () returned 0x0 [0140.157] RmGetList () returned 0x0 [0143.809] RmShutdown () returned 0x0 [0145.083] RmEndSession () returned 0x0 [0145.084] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261488) returned 1 [0145.084] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0145.084] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0145.084] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0145.084] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0145.084] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=77022) returned 1 [0145.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ad9f8 [0145.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a2b020 [0145.102] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0145.102] ReadFile (in: hFile=0x5c0, lpBuffer=0x6a2b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6a2b040*, lpNumberOfBytesRead=0x302f694*=0x12cde, lpOverlapped=0x0) returned 1 [0145.585] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0145.585] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.585] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.586] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.586] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.587] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.587] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.587] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x302f608*=0x2000) returned 1 [0145.587] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0145.587] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0145.587] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0145.587] WriteFile (in: hFile=0x5c0, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0145.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a2b020 | out: hHeap=0x310000) returned 1 [0146.124] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ad9f8 | out: hHeap=0x310000) returned 1 [0146.124] CloseHandle (hObject=0x5c0) returned 1 [0146.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0146.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb8a8 [0146.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1fd0 [0146.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0146.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0146.126] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1035\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0146.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0146.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397f00 [0146.127] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0146.127] GetLastError () returned 0x0 [0146.127] SetLastError (dwErrCode=0x0) [0146.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb2d0 [0146.127] GetLastError () returned 0x0 [0146.127] SetLastError (dwErrCode=0x0) [0146.127] GetLastError () returned 0x0 [0146.127] SetLastError (dwErrCode=0x0) [0146.127] GetLastError () returned 0x0 [0146.127] SetLastError (dwErrCode=0x0) [0146.127] GetLastError () returned 0x0 [0146.128] SetLastError (dwErrCode=0x0) [0146.128] GetLastError () returned 0x0 [0146.128] SetLastError (dwErrCode=0x0) [0146.128] GetLastError () returned 0x0 [0146.128] SetLastError (dwErrCode=0x0) [0146.128] GetLastError () returned 0x0 [0146.128] SetLastError (dwErrCode=0x0) [0146.128] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb2d0 | out: hHeap=0x310000) returned 1 [0146.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0146.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x302f4d0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0146.128] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0146.128] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0146.128] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0146.129] WriteFile (in: hFile=0x5c0, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x302f608*=0xe59, lpOverlapped=0x0) returned 1 [0146.130] CloseHandle (hObject=0x5c0) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397f00 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1fd0 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0146.130] CryptDestroyKey (hKey=0x5261488) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b78 | out: hHeap=0x310000) returned 1 [0146.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18f20 | out: hHeap=0x310000) returned 1 [0146.130] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0146.130] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0146.131] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.131] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0146.133] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.133] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0146.134] CloseHandle (hObject=0x5c0) returned 1 [0146.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a27f0 [0146.134] RmStartSession () returned 0x0 [0146.607] RmRegisterResources () returned 0x0 [0146.612] RmGetList () returned 0x0 [0146.766] RmShutdown () returned 0x0 [0147.250] RmEndSession () returned 0x0 [0147.289] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261488) returned 1 [0147.289] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0147.289] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0147.289] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0147.289] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0147.289] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=77680) returned 1 [0147.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5ef4008 [0147.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6732020 [0147.306] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0147.306] ReadFile (in: hFile=0x574, lpBuffer=0x6732040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6732040*, lpNumberOfBytesRead=0x302f694*=0x12f70, lpOverlapped=0x0) returned 1 [0147.335] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.335] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.335] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.336] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.336] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.336] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.336] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.336] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.336] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.336] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5ef4020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0147.336] WriteFile (in: hFile=0x574, lpBuffer=0x5ef4020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5ef4020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0147.336] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0147.336] WriteFile (in: hFile=0x574, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0147.337] WriteFile (in: hFile=0x574, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0147.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6732020 | out: hHeap=0x310000) returned 1 [0147.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ef4008 | out: hHeap=0x310000) returned 1 [0147.342] CloseHandle (hObject=0x574) returned 1 [0147.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0147.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0147.345] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0147.345] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb2d0 [0147.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0147.345] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1053\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0147.345] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0147.345] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3981d0 [0147.345] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0147.345] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0147.346] GetLastError () returned 0x0 [0147.346] SetLastError (dwErrCode=0x0) [0147.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0147.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x302f4d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aA4HcB1IE", lpUsedDefaultChar=0x0) returned 9 [0147.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0147.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0147.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0147.347] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0147.481] WriteFile (in: hFile=0x574, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x302f608*=0xe5c, lpOverlapped=0x0) returned 1 [0147.482] CloseHandle (hObject=0x574) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3981d0 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb2d0 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0147.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0147.482] CryptDestroyKey (hKey=0x5261488) returned 1 [0147.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a27f0 | out: hHeap=0x310000) returned 1 [0147.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50603c0 | out: hHeap=0x310000) returned 1 [0147.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c196f0 | out: hHeap=0x310000) returned 1 [0147.791] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0147.791] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c [0147.791] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.792] ReadFile (in: hFile=0x65c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0147.794] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.794] ReadFile (in: hFile=0x65c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0147.794] CloseHandle (hObject=0x65c) returned 1 [0147.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399ae0 [0147.794] RmStartSession () returned 0x0 [0147.798] RmRegisterResources () returned 0x0 [0147.802] RmGetList () returned 0x0 [0147.985] RmShutdown () returned 0x0 [0151.021] RmEndSession () returned 0x0 [0151.096] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261848) returned 1 [0151.096] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0151.096] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x80) returned 1 [0151.096] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0151.096] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0151.096] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=4015) returned 1 [0151.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c94018 [0151.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6848020 [0151.115] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0151.115] ReadFile (in: hFile=0x664, lpBuffer=0x6848040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6848040*, lpNumberOfBytesRead=0x302f694*=0xfaf, lpOverlapped=0x0) returned 1 [0151.116] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0151.116] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c94020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c94020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0151.116] WriteFile (in: hFile=0x664, lpBuffer=0x5c94020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5c94020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0151.117] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0151.117] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0151.117] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0151.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6848020 | out: hHeap=0x310000) returned 1 [0151.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94018 | out: hHeap=0x310000) returned 1 [0151.122] CloseHandle (hObject=0x664) returned 1 [0151.125] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0151.125] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a23e0 [0151.125] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0151.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c28 [0151.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0151.126] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\2070\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0151.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0151.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0151.150] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0151.150] GetLastError () returned 0x0 [0151.150] SetLastError (dwErrCode=0x0) [0151.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a36f8 [0151.150] GetLastError () returned 0x0 [0151.150] SetLastError (dwErrCode=0x0) [0151.150] GetLastError () returned 0x0 [0151.150] SetLastError (dwErrCode=0x0) [0151.150] GetLastError () returned 0x0 [0151.150] SetLastError (dwErrCode=0x0) [0151.150] GetLastError () returned 0x0 [0151.150] SetLastError (dwErrCode=0x0) [0151.150] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bc00 [0151.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0151.151] GetLastError () returned 0x0 [0151.151] SetLastError (dwErrCode=0x0) [0151.151] GetLastError () returned 0x0 [0151.152] SetLastError (dwErrCode=0x0) [0151.152] GetLastError () returned 0x0 [0151.152] SetLastError (dwErrCode=0x0) [0151.152] GetLastError () returned 0x0 [0151.152] SetLastError (dwErrCode=0x0) [0151.152] GetLastError () returned 0x0 [0151.152] SetLastError (dwErrCode=0x0) [0151.152] GetLastError () returned 0x0 [0151.152] SetLastError (dwErrCode=0x0) [0151.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a36f8 | out: hHeap=0x310000) returned 1 [0151.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0151.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0151.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0151.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bc00 | out: hHeap=0x310000) returned 1 [0151.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0151.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0151.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39580 [0151.152] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0151.152] WriteFile (in: hFile=0x664, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x302f608*=0xe69, lpOverlapped=0x0) returned 1 [0151.153] CloseHandle (hObject=0x664) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39580 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c28 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0151.154] CryptDestroyKey (hKey=0x5261848) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399ae0 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e55d0 | out: hHeap=0x310000) returned 1 [0151.154] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19970 | out: hHeap=0x310000) returned 1 [0151.154] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0151.154] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0151.154] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.154] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0151.220] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.220] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0151.220] CloseHandle (hObject=0x664) returned 1 [0151.221] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2518 [0151.221] RmStartSession () returned 0x0 [0151.278] RmRegisterResources () returned 0x0 [0151.282] RmGetList () returned 0x0 [0154.889] RmShutdown () returned 0x0 [0158.189] RmEndSession () returned 0x0 [0158.190] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260bc8) returned 1 [0158.190] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0158.190] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico", dwFileAttributes=0x80) returned 1 [0158.190] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0158.190] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0158.190] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=894) returned 1 [0158.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bbc5e8 [0158.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6d0c020 [0158.599] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0158.600] ReadFile (in: hFile=0x664, lpBuffer=0x6d0c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6d0c040*, lpNumberOfBytesRead=0x302f694*=0x37e, lpOverlapped=0x0) returned 1 [0158.601] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0158.601] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x302f608*=0x2000) returned 1 [0158.601] WriteFile (in: hFile=0x664, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0158.602] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0158.602] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0158.602] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0158.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6d0c020 | out: hHeap=0x310000) returned 1 [0159.661] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbc5e8 | out: hHeap=0x310000) returned 1 [0159.661] CloseHandle (hObject=0x664) returned 1 [0159.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0159.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f05b8 [0159.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0159.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0159.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f05b8 | out: hHeap=0x310000) returned 1 [0159.662] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0159.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0159.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0159.663] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0159.663] GetLastError () returned 0x0 [0159.663] SetLastError (dwErrCode=0x0) [0159.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0159.663] GetLastError () returned 0x0 [0159.663] SetLastError (dwErrCode=0x0) [0159.663] GetLastError () returned 0x0 [0159.663] SetLastError (dwErrCode=0x0) [0159.663] GetLastError () returned 0x0 [0159.663] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.664] SetLastError (dwErrCode=0x0) [0159.664] GetLastError () returned 0x0 [0159.665] SetLastError (dwErrCode=0x0) [0159.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0159.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0159.665] GetLastError () returned 0x0 [0159.665] SetLastError (dwErrCode=0x0) [0159.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0159.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0159.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x38c188, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r8qa7ZyzJ1OtQOBkD", lpUsedDefaultChar=0x0) returned 17 [0159.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0159.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0159.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0159.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0630 [0159.665] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0159.666] WriteFile (in: hFile=0x664, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x302f608*=0xe64, lpOverlapped=0x0) returned 1 [0159.667] CloseHandle (hObject=0x664) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0630 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0159.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0159.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0159.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0159.668] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0159.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2518 | out: hHeap=0x310000) returned 1 [0159.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50601b8 | out: hHeap=0x310000) returned 1 [0159.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3271a0 | out: hHeap=0x310000) returned 1 [0159.668] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0159.668] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0159.668] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.668] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0159.670] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.670] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0159.670] CloseHandle (hObject=0x664) returned 1 [0159.670] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0159.670] RmStartSession () returned 0x0 [0159.673] RmRegisterResources () returned 0x0 [0159.673] RmGetList () returned 0x0 [0160.896] RmShutdown () returned 0x0 [0166.792] RmEndSession () returned 0x0 [0166.794] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52610c8) returned 1 [0166.794] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0166.794] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0166.794] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0166.794] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0166.794] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=5198099) returned 1 [0166.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x53456e0 [0166.795] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6d81020 [0167.563] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0167.563] ReadFile (in: hFile=0x664, lpBuffer=0x6d81040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6d81040*, lpNumberOfBytesRead=0x302f694*=0x100000, lpOverlapped=0x0) returned 1 [0167.576] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0167.581] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.581] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.581] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.581] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.581] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.581] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.582] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.582] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.583] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.583] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.584] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.584] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.585] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.585] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.586] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.587] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.587] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.588] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.588] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.589] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.589] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.590] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.590] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.591] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.591] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.592] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.592] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.593] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.593] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.594] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.594] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.595] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.595] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.596] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.596] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.597] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.597] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.598] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.599] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.599] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.600] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.600] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.600] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.600] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.600] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.600] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.600] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.600] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x302f608*=0x2000) returned 1 [0167.600] WriteFile (in: hFile=0x664, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0167.600] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0167.774] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0167.775] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0167.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6d81020 | out: hHeap=0x310000) returned 1 [0167.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53456e0 | out: hHeap=0x310000) returned 1 [0167.916] CloseHandle (hObject=0x664) returned 1 [0169.478] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0169.478] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53215c0 [0169.478] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3c48 [0169.478] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321f40 [0169.478] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53215c0 | out: hHeap=0x310000) returned 1 [0169.478] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.bdcddcbaad"), dwFlags=0x1) returned 1 [0169.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3e68 [0169.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0169.479] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0169.479] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4330 [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] GetLastError () returned 0x0 [0169.480] SetLastError (dwErrCode=0x0) [0169.480] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b810 [0169.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0169.481] GetLastError () returned 0x0 [0169.481] SetLastError (dwErrCode=0x0) [0169.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4330 | out: hHeap=0x310000) returned 1 [0169.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0169.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x38c188, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vsPfwZLZiAU4bA46v", lpUsedDefaultChar=0x0) returned 17 [0169.482] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b810 | out: hHeap=0x310000) returned 1 [0169.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0169.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bad110 [0169.482] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0169.482] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0169.483] WriteFile (in: hFile=0x664, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x302f608*=0xe64, lpOverlapped=0x0) returned 1 [0169.484] CloseHandle (hObject=0x664) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3e68 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321f40 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3c48 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0169.485] CryptDestroyKey (hKey=0x52610c8) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0169.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365408 | out: hHeap=0x310000) returned 1 [0169.485] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0169.485] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0169.486] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.486] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0169.488] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.488] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0169.488] CloseHandle (hObject=0x664) returned 1 [0169.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321ea8 [0169.488] RmStartSession () returned 0x0 [0169.493] RmRegisterResources () returned 0x0 [0169.963] RmGetList () returned 0x0 [0173.154] RmShutdown () returned 0x0 [0175.479] RmEndSession () returned 0x0 [0175.480] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261908) returned 1 [0175.480] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0175.480] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x20) returned 1 [0175.480] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0175.480] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0175.480] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=69632) returned 1 [0175.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0175.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x67ad020 [0175.810] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0175.810] ReadFile (in: hFile=0x664, lpBuffer=0x67ad040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x67ad040*, lpNumberOfBytesRead=0x302f694*=0x11000, lpOverlapped=0x0) returned 1 [0175.816] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0175.816] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.816] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.816] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.816] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.816] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.816] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.816] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.816] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0175.817] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0175.817] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0175.818] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0175.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x67ad020 | out: hHeap=0x310000) returned 1 [0175.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0175.979] CloseHandle (hObject=0x664) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5dff300 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321f40 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5dfeb20 [0175.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dff300 | out: hHeap=0x310000) returned 1 [0175.982] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0175.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0175.982] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] GetLastError () returned 0x0 [0175.983] SetLastError (dwErrCode=0x0) [0175.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0175.983] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0175.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x302f4d0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0175.983] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0175.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0175.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0175.984] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0175.984] WriteFile (in: hFile=0x664, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x302f608*=0xe5b, lpOverlapped=0x0) returned 1 [0175.985] CloseHandle (hObject=0x664) returned 1 [0175.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0175.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0175.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0175.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dfeb20 | out: hHeap=0x310000) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321f40 | out: hHeap=0x310000) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0175.986] CryptDestroyKey (hKey=0x5261908) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321ea8 | out: hHeap=0x310000) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c740 | out: hHeap=0x310000) returned 1 [0175.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e62e0 | out: hHeap=0x310000) returned 1 [0175.986] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0175.986] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0175.986] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.986] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0176.025] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.025] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0176.025] CloseHandle (hObject=0x664) returned 1 [0176.025] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0176.025] RmStartSession () returned 0x0 [0176.028] RmRegisterResources () returned 0x0 [0176.031] RmGetList () returned 0x0 [0176.560] RmShutdown () returned 0x0 [0179.988] RmEndSession () returned 0x0 [0180.139] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261848) returned 1 [0180.139] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0180.139] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0180.140] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0180.140] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0180.140] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=69632) returned 1 [0180.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5e3d008 [0180.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677f020 [0180.157] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0180.157] ReadFile (in: hFile=0x664, lpBuffer=0x677f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x677f040*, lpNumberOfBytesRead=0x302f694*=0x11000, lpOverlapped=0x0) returned 1 [0180.252] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.253] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.253] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.254] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.254] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.254] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.254] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0180.254] WriteFile (in: hFile=0x664, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0180.254] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0180.254] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0180.254] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0180.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677f020 | out: hHeap=0x310000) returned 1 [0180.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e3d008 | out: hHeap=0x310000) returned 1 [0180.259] CloseHandle (hObject=0x664) returned 1 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53231a8 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5323370 [0180.262] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53231a8 | out: hHeap=0x310000) returned 1 [0180.262] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0180.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0180.263] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.263] SetLastError (dwErrCode=0x0) [0180.263] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0180.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] GetLastError () returned 0x0 [0180.264] SetLastError (dwErrCode=0x0) [0180.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0180.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0180.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x38c3e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LEa8akVxyvJo8s5UpDdBd", lpUsedDefaultChar=0x0) returned 21 [0180.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0180.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0180.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bad110 [0180.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0180.265] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0180.265] WriteFile (in: hFile=0x664, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x302f608*=0xe68, lpOverlapped=0x0) returned 1 [0180.266] CloseHandle (hObject=0x664) returned 1 [0180.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0180.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0180.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5323370 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0180.267] CryptDestroyKey (hKey=0x5261848) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea7a8 | out: hHeap=0x310000) returned 1 [0180.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6100 | out: hHeap=0x310000) returned 1 [0180.267] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0180.267] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0180.267] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.267] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0180.306] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.306] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0180.306] CloseHandle (hObject=0x664) returned 1 [0180.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0798 [0180.307] RmStartSession () returned 0x0 [0180.312] RmRegisterResources () returned 0x0 [0180.316] RmGetList () returned 0x0 [0182.203] RmShutdown () returned 0x0 [0185.827] RmEndSession () returned 0x0 [0186.262] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261908) returned 1 [0186.262] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0186.262] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0186.262] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0186.262] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0186.263] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=69632) returned 1 [0186.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd4078 [0186.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f6020 [0186.280] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0186.280] ReadFile (in: hFile=0x664, lpBuffer=0x56f6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x56f6040*, lpNumberOfBytesRead=0x302f694*=0x11000, lpOverlapped=0x0) returned 1 [0186.414] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0186.414] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.414] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.414] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.414] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.414] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.414] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.415] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.415] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.415] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.415] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.415] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.416] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0186.416] WriteFile (in: hFile=0x664, lpBuffer=0x5bd4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd4080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0186.416] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0186.416] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0186.416] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0186.417] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f6020 | out: hHeap=0x310000) returned 1 [0186.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd4078 | out: hHeap=0x310000) returned 1 [0186.422] CloseHandle (hObject=0x664) returned 1 [0186.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0186.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0186.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0186.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0186.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0186.424] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0186.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0090 [0186.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0186.425] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.425] GetLastError () returned 0x0 [0186.425] SetLastError (dwErrCode=0x0) [0186.426] GetLastError () returned 0x0 [0186.426] SetLastError (dwErrCode=0x0) [0186.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0186.426] GetLastError () returned 0x0 [0186.426] SetLastError (dwErrCode=0x0) [0186.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0186.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTiH5xEIV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTiH5xEIV", cchWideChar=9, lpMultiByteStr=0x302f4d0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTiH5xEIV", lpUsedDefaultChar=0x0) returned 9 [0186.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0186.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0186.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0186.426] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0186.427] WriteFile (in: hFile=0x664, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x302f608*=0xe5c, lpOverlapped=0x0) returned 1 [0186.428] CloseHandle (hObject=0x664) returned 1 [0186.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0090 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0186.429] CryptDestroyKey (hKey=0x5261908) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b0d0 | out: hHeap=0x310000) returned 1 [0186.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6b50 | out: hHeap=0x310000) returned 1 [0186.430] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0186.430] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0186.430] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.430] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0186.551] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.551] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0186.551] CloseHandle (hObject=0x664) returned 1 [0186.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0630 [0186.551] RmStartSession () returned 0x0 [0186.553] RmRegisterResources () returned 0x0 [0186.557] RmGetList () returned 0x0 [0186.909] RmShutdown () returned 0x0 [0188.451] RmEndSession () returned 0x0 [0188.452] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261408) returned 1 [0188.452] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0188.452] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x20) returned 1 [0188.452] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0188.452] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0188.452] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=69632) returned 1 [0188.453] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2010 [0188.453] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x66a6020 [0189.050] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0189.050] ReadFile (in: hFile=0x664, lpBuffer=0x66a6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x66a6040*, lpNumberOfBytesRead=0x302f694*=0x11000, lpOverlapped=0x0) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0189.053] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.054] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.054] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.055] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.055] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.055] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0189.055] WriteFile (in: hFile=0x664, lpBuffer=0x5bd2020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bd2020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0189.055] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0189.055] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0189.055] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0189.055] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x66a6020 | out: hHeap=0x310000) returned 1 [0190.080] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2010 | out: hHeap=0x310000) returned 1 [0190.080] CloseHandle (hObject=0x664) returned 1 [0190.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0190.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0190.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0810 [0190.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0190.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0190.082] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0900 [0190.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.082] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0190.082] GetLastError () returned 0x0 [0190.082] SetLastError (dwErrCode=0x0) [0190.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.083] SetLastError (dwErrCode=0x0) [0190.083] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0190.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] GetLastError () returned 0x0 [0190.084] SetLastError (dwErrCode=0x0) [0190.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0190.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0190.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0190.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x38c3e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tRdDQltWN4PVKdRqXUoqyy", lpUsedDefaultChar=0x0) returned 22 [0190.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0190.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540b990 [0190.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540f3b0 [0190.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0190.084] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0190.085] WriteFile (in: hFile=0x664, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x302f608*=0xe69, lpOverlapped=0x0) returned 1 [0190.086] CloseHandle (hObject=0x664) returned 1 [0190.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0190.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0190.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0190.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0810 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0190.087] CryptDestroyKey (hKey=0x5261408) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0630 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0190.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365b88 | out: hHeap=0x310000) returned 1 [0190.087] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0190.087] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0190.087] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.087] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0190.089] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.089] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0190.089] CloseHandle (hObject=0x664) returned 1 [0190.089] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0190.089] RmStartSession () returned 0x0 [0190.093] RmRegisterResources () returned 0x0 [0190.097] RmGetList () returned 0x0 [0190.614] RmShutdown () returned 0x0 [0194.599] RmEndSession () returned 0x0 [0194.599] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261948) returned 1 [0194.599] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0194.600] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0194.600] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0194.600] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0194.600] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=69632) returned 1 [0194.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5421cc0 [0194.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621b020 [0194.925] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0194.925] ReadFile (in: hFile=0x664, lpBuffer=0x621b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x621b040*, lpNumberOfBytesRead=0x302f694*=0x11000, lpOverlapped=0x0) returned 1 [0194.927] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.927] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.927] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.927] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.927] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.927] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.927] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.928] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.928] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.928] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.928] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.928] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.928] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5421ce0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0194.928] WriteFile (in: hFile=0x664, lpBuffer=0x5421ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5421ce0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0194.928] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0194.929] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0194.929] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0194.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621b020 | out: hHeap=0x310000) returned 1 [0197.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5421cc0 | out: hHeap=0x310000) returned 1 [0197.152] CloseHandle (hObject=0x664) returned 1 [0197.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0197.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a7c00 [0197.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0197.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8878 [0197.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a7c00 | out: hHeap=0x310000) returned 1 [0197.153] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0197.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0798 [0197.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.153] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc808 [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.154] SetLastError (dwErrCode=0x0) [0197.154] GetLastError () returned 0x0 [0197.155] SetLastError (dwErrCode=0x0) [0197.155] GetLastError () returned 0x0 [0197.155] SetLastError (dwErrCode=0x0) [0197.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc808 | out: hHeap=0x310000) returned 1 [0197.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OpsjFeOClMNTu", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0197.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OpsjFeOClMNTu", cchWideChar=13, lpMultiByteStr=0x302f4d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpsjFeOClMNTu", lpUsedDefaultChar=0x0) returned 13 [0197.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0197.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0197.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0197.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3982a8 [0197.155] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0197.156] WriteFile (in: hFile=0x664, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x302f608*=0xe60, lpOverlapped=0x0) returned 1 [0197.157] CloseHandle (hObject=0x664) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3982a8 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8878 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0197.157] CryptDestroyKey (hKey=0x5261948) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a398 | out: hHeap=0x310000) returned 1 [0197.157] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44da8 | out: hHeap=0x310000) returned 1 [0197.157] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0197.157] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0197.157] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.157] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0197.159] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.159] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0197.160] CloseHandle (hObject=0x664) returned 1 [0197.160] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5ce0 [0197.160] RmStartSession () returned 0x0 [0197.161] RmRegisterResources () returned 0x0 [0197.166] RmGetList () returned 0x0 [0197.833] RmShutdown () returned 0x0 [0200.213] RmEndSession () returned 0x0 [0200.214] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261488) returned 1 [0200.214] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0200.214] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", dwFileAttributes=0x20) returned 0 [0200.214] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.214] CryptDestroyKey (hKey=0x5261488) returned 1 [0200.214] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5ce0 | out: hHeap=0x310000) returned 1 [0200.214] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92970 | out: hHeap=0x310000) returned 1 [0200.214] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07b00 | out: hHeap=0x310000) returned 1 [0200.214] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0200.214] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0200.215] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.215] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0200.238] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.238] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0200.238] CloseHandle (hObject=0x664) returned 1 [0200.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b62c8 [0200.238] RmStartSession () returned 0x0 [0200.240] RmRegisterResources () returned 0x0 [0200.240] RmGetList () returned 0x0 [0204.735] RmShutdown () returned 0x0 [0205.930] RmEndSession () returned 0x0 [0206.209] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261488) returned 1 [0206.209] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0206.209] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui", dwFileAttributes=0x20) returned 0 [0206.209] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.209] CryptDestroyKey (hKey=0x5261488) returned 1 [0206.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b62c8 | out: hHeap=0x310000) returned 1 [0206.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92820 | out: hHeap=0x310000) returned 1 [0206.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07e70 | out: hHeap=0x310000) returned 1 [0206.209] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0206.209] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0206.210] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.210] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0206.218] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.218] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0206.218] CloseHandle (hObject=0x618) returned 1 [0206.218] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0206.218] RmStartSession () returned 0x0 [0206.220] RmRegisterResources () returned 0x0 [0206.224] RmGetList () returned 0x0 [0206.677] RmShutdown () returned 0x0 [0208.321] RmEndSession () returned 0x0 [0208.911] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261948) returned 1 [0208.911] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0208.911] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", dwFileAttributes=0x20) returned 0 [0208.911] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.911] CryptDestroyKey (hKey=0x5261948) returned 1 [0208.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0208.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93b28 | out: hHeap=0x310000) returned 1 [0208.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08910 | out: hHeap=0x310000) returned 1 [0208.912] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0208.912] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0208.913] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.913] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0208.927] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.927] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0208.927] CloseHandle (hObject=0x618) returned 1 [0208.927] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ecc40 [0208.927] RmStartSession () returned 0x0 [0208.966] RmRegisterResources () returned 0x0 [0208.967] RmGetList () returned 0x0 [0209.387] RmShutdown () returned 0x0 [0211.344] RmEndSession () returned 0x0 [0211.345] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x35dbc8) returned 1 [0211.345] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0211.345] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", dwFileAttributes=0x20) returned 0 [0211.345] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.345] CryptDestroyKey (hKey=0x35dbc8) returned 1 [0211.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ecc40 | out: hHeap=0x310000) returned 1 [0211.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dce48 | out: hHeap=0x310000) returned 1 [0211.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5ba0 | out: hHeap=0x310000) returned 1 [0211.345] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0211.345] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0211.346] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.346] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0211.347] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.347] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0211.347] CloseHandle (hObject=0x678) returned 1 [0211.347] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92cb8 [0211.347] RmStartSession () returned 0x0 [0211.348] RmRegisterResources () returned 0x0 [0211.348] RmGetList () returned 0x0 [0212.802] RmShutdown () returned 0x0 [0213.255] RmEndSession () returned 0x0 [0213.757] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260e08) returned 1 [0213.757] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0213.757] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", dwFileAttributes=0x20) returned 0 [0213.757] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.757] CryptDestroyKey (hKey=0x5260e08) returned 1 [0213.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92cb8 | out: hHeap=0x310000) returned 1 [0213.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93f18 | out: hHeap=0x310000) returned 1 [0213.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5a10 | out: hHeap=0x310000) returned 1 [0213.757] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0213.757] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0213.857] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.858] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0213.910] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.910] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0213.910] CloseHandle (hObject=0x5c0) returned 1 [0213.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc6e0 [0213.911] RmStartSession () returned 0x0 [0213.917] RmRegisterResources () returned 0x0 [0213.921] RmGetList () returned 0x0 [0214.764] RmShutdown () returned 0x0 [0215.176] RmEndSession () returned 0x0 [0215.178] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52619c8) returned 1 [0215.178] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0215.178] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml", dwFileAttributes=0x20) returned 0 [0215.178] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.178] CryptDestroyKey (hKey=0x52619c8) returned 1 [0215.178] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc6e0 | out: hHeap=0x310000) returned 1 [0215.178] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea038 | out: hHeap=0x310000) returned 1 [0215.178] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5650 | out: hHeap=0x310000) returned 1 [0215.179] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0215.179] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0215.179] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.179] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0215.180] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.180] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0215.180] CloseHandle (hObject=0x5c0) returned 1 [0215.181] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc548 [0215.181] RmStartSession () returned 0x0 [0215.183] RmRegisterResources () returned 0x0 [0215.184] RmGetList () returned 0x0 [0220.703] RmShutdown () returned 0x0 [0221.731] RmEndSession () returned 0x0 [0222.295] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261488) returned 1 [0222.295] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0222.295] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml", dwFileAttributes=0x20) returned 0 [0222.295] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.295] CryptDestroyKey (hKey=0x5261488) returned 1 [0222.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc548 | out: hHeap=0x310000) returned 1 [0222.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb4f0 | out: hHeap=0x310000) returned 1 [0222.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5dd0 | out: hHeap=0x310000) returned 1 [0222.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0222.296] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0222.296] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.296] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0222.311] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.311] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0222.311] CloseHandle (hObject=0x5c0) returned 1 [0222.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93348 [0222.311] RmStartSession () returned 0x0 [0222.323] RmRegisterResources () returned 0x0 [0222.324] RmGetList () returned 0x0 [0222.497] RmShutdown () returned 0x0 [0223.763] RmEndSession () returned 0x0 [0223.764] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52617c8) returned 1 [0223.764] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0223.764] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0223.764] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.764] CryptDestroyKey (hKey=0x52617c8) returned 1 [0223.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93348 | out: hHeap=0x310000) returned 1 [0223.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eec78 | out: hHeap=0x310000) returned 1 [0223.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14600 | out: hHeap=0x310000) returned 1 [0223.764] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0223.764] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0223.765] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.765] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0223.766] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.766] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0223.766] CloseHandle (hObject=0x5c0) returned 1 [0223.766] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b62c8 [0223.766] RmStartSession () returned 0x0 [0223.768] RmRegisterResources () returned 0x0 [0223.772] RmGetList () returned 0x0 [0224.351] RmShutdown () returned 0x0 [0224.877] RmEndSession () returned 0x0 [0224.877] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261448) returned 1 [0224.878] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0224.878] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0224.878] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.878] CryptDestroyKey (hKey=0x5261448) returned 1 [0224.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b62c8 | out: hHeap=0x310000) returned 1 [0224.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee2a0 | out: hHeap=0x310000) returned 1 [0224.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14420 | out: hHeap=0x310000) returned 1 [0224.879] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0224.879] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0224.881] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.881] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0224.885] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.885] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0224.885] CloseHandle (hObject=0x5c0) returned 1 [0224.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5bccbd0 [0224.885] RmStartSession () returned 0x0 [0225.776] RmRegisterResources () returned 0x0 [0226.561] RmGetList () returned 0x0 [0227.658] RmShutdown () returned 0x0 [0229.085] RmEndSession () returned 0x0 [0229.086] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260f88) returned 1 [0229.086] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0229.087] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms", dwFileAttributes=0x20) returned 1 [0229.087] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0229.087] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0229.088] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=590523) returned 1 [0229.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5f29f18 [0229.090] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ed020 [0229.528] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0229.528] ReadFile (in: hFile=0x5c0, lpBuffer=0x49ed040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x49ed040*, lpNumberOfBytesRead=0x302f694*=0x902bb, lpOverlapped=0x0) returned 1 [0229.536] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0229.536] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.536] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.537] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.537] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.538] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.538] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.539] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.539] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.540] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.540] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.541] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.541] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.542] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.542] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.543] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.543] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.543] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.543] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.543] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.543] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.544] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.544] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.545] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.545] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.546] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.546] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.547] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f29f20*, pdwDataLen=0x302f608*=0x2000) returned 1 [0229.547] WriteFile (in: hFile=0x5c0, lpBuffer=0x5f29f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5f29f20*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0229.548] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0229.548] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0229.548] WriteFile (in: hFile=0x5c0, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0229.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ed020 | out: hHeap=0x310000) returned 1 [0229.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f29f18 | out: hHeap=0x310000) returned 1 [0229.759] CloseHandle (hObject=0x5c0) returned 1 [0229.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0229.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xf0) returned 0x5eb0d10 [0229.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f1e458 [0229.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xf0) returned 0x5eb0550 [0229.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5eb0d10 | out: hHeap=0x310000) returned 1 [0229.760] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.bdcddcbaad"), dwFlags=0x1) returned 1 [0229.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f1fa18 [0229.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc660 [0229.761] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0229.761] GetLastError () returned 0x0 [0229.761] SetLastError (dwErrCode=0x0) [0229.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0229.761] GetLastError () returned 0x0 [0229.761] SetLastError (dwErrCode=0x0) [0229.761] GetLastError () returned 0x0 [0229.761] SetLastError (dwErrCode=0x0) [0229.761] GetLastError () returned 0x0 [0229.761] SetLastError (dwErrCode=0x0) [0229.761] GetLastError () returned 0x0 [0229.761] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bab0 [0229.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0229.762] GetLastError () returned 0x0 [0229.762] SetLastError (dwErrCode=0x0) [0229.762] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] GetLastError () returned 0x0 [0229.763] SetLastError (dwErrCode=0x0) [0229.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x52f7360 [0229.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bab0 | out: hHeap=0x310000) returned 1 [0229.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0229.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="esN4DjsqU9pi3ETkQZZSNft5", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0229.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0229.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="esN4DjsqU9pi3ETkQZZSNft5", cchWideChar=24, lpMultiByteStr=0x38c390, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esN4DjsqU9pi3ETkQZZSNft5", lpUsedDefaultChar=0x0) returned 24 [0229.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52f7360 | out: hHeap=0x310000) returned 1 [0229.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0229.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0229.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x5d08838 [0229.763] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0229.764] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x302f608*=0xe6b, lpOverlapped=0x0) returned 1 [0229.765] CloseHandle (hObject=0x5c0) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d08838 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f1fa18 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5eb0550 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f1e458 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0229.765] CryptDestroyKey (hKey=0x5260f88) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bccbd0 | out: hHeap=0x310000) returned 1 [0229.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44470 | out: hHeap=0x310000) returned 1 [0229.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14240 | out: hHeap=0x310000) returned 1 [0229.766] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0229.766] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0229.767] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.767] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0229.800] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.800] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0229.800] CloseHandle (hObject=0x5c0) returned 1 [0229.800] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0229.800] RmStartSession () returned 0x0 [0229.844] RmRegisterResources () returned 0x0 [0229.844] RmGetList () returned 0x0 [0230.803] RmShutdown () returned 0x0 [0231.669] RmEndSession () returned 0x0 [0231.983] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261748) returned 1 [0231.983] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0231.983] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adojavas.inc", dwFileAttributes=0x20) returned 0 [0231.983] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.983] CryptDestroyKey (hKey=0x5261748) returned 1 [0231.983] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0231.983] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0231.983] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ac0 | out: hHeap=0x310000) returned 1 [0231.983] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0231.983] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0231.984] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.984] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0232.080] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.080] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0232.080] CloseHandle (hObject=0x5c0) returned 1 [0232.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0232.080] RmStartSession () returned 0x0 [0232.081] RmRegisterResources () returned 0x0 [0232.082] RmGetList () returned 0x0 [0233.340] RmShutdown () returned 0x0 [0234.282] RmEndSession () returned 0x0 [0234.283] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261388) returned 1 [0234.283] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0234.283] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", dwFileAttributes=0x20) returned 0 [0234.283] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.284] CryptDestroyKey (hKey=0x5261388) returned 1 [0234.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0234.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55719d0 | out: hHeap=0x310000) returned 1 [0234.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572ba8 | out: hHeap=0x310000) returned 1 [0234.284] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0234.284] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0234.284] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.284] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0234.325] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.325] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0234.325] CloseHandle (hObject=0x5c0) returned 1 [0234.325] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19b28 [0234.325] RmStartSession () returned 0x0 [0234.326] RmRegisterResources () returned 0x0 [0234.327] RmGetList () returned 0x0 [0236.952] RmShutdown () returned 0x0 [0238.946] RmEndSession () returned 0x0 [0238.946] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52614c8) returned 1 [0238.946] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0238.947] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\images\\bing.ico", dwFileAttributes=0x20) returned 0 [0238.947] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.947] CryptDestroyKey (hKey=0x52614c8) returned 1 [0238.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19b28 | out: hHeap=0x310000) returned 1 [0238.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a500 | out: hHeap=0x310000) returned 1 [0238.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572388 | out: hHeap=0x310000) returned 1 [0238.947] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0238.947] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0238.947] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.947] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0238.987] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.987] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0238.987] CloseHandle (hObject=0x5c0) returned 1 [0238.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0238.987] RmStartSession () returned 0x0 [0238.988] RmRegisterResources () returned 0x0 [0238.989] RmGetList () returned 0x0 [0240.436] RmShutdown () returned 0x0 [0241.998] RmEndSession () returned 0x0 [0242.276] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261ac8) returned 1 [0242.276] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0242.276] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties", dwFileAttributes=0x20) returned 1 [0242.276] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0242.276] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0242.277] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=3409) returned 1 [0242.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0242.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c29020 [0242.294] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0242.294] ReadFile (in: hFile=0x5c0, lpBuffer=0x4c29040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x4c29040*, lpNumberOfBytesRead=0x302f694*=0xd51, lpOverlapped=0x0) returned 1 [0242.341] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0242.341] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x302f608*=0x2000) returned 1 [0242.341] WriteFile (in: hFile=0x5c0, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0242.342] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0242.342] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0242.342] WriteFile (in: hFile=0x5c0, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0242.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c29020 | out: hHeap=0x310000) returned 1 [0242.349] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0242.349] CloseHandle (hObject=0x5c0) returned 1 [0242.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0242.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc158 [0242.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0242.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcd90 [0242.350] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc158 | out: hHeap=0x310000) returned 1 [0242.350] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0242.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0242.350] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0242.350] GetLastError () returned 0x0 [0242.350] SetLastError (dwErrCode=0x0) [0242.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0242.351] GetLastError () returned 0x0 [0242.351] SetLastError (dwErrCode=0x0) [0242.351] GetLastError () returned 0x0 [0242.351] SetLastError (dwErrCode=0x0) [0242.351] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0242.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0242.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x302f4d0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0242.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0242.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0242.351] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0242.352] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x302f608*=0xe54, lpOverlapped=0x0) returned 1 [0242.352] CloseHandle (hObject=0x5c0) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0242.353] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570340 | out: hHeap=0x310000) returned 1 [0242.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55726a8 | out: hHeap=0x310000) returned 1 [0242.353] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0242.353] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0242.353] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.353] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0242.391] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.391] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0242.391] CloseHandle (hObject=0x5c0) returned 1 [0242.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0242.391] RmStartSession () returned 0x0 [0242.392] RmRegisterResources () returned 0x0 [0242.393] RmGetList () returned 0x0 [0242.963] RmShutdown () returned 0x0 [0245.738] RmEndSession () returned 0x0 [0245.739] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52615c8) returned 1 [0245.739] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0245.739] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar", dwFileAttributes=0x20) returned 1 [0245.739] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0245.739] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0245.739] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=2022734) returned 1 [0245.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54cfe68 [0245.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cf020 [0247.420] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.421] GetLastError () returned 0x0 [0247.421] SetLastError (dwErrCode=0x0) [0247.422] GetLastError () returned 0x0 [0247.422] SetLastError (dwErrCode=0x0) [0247.422] GetLastError () returned 0x0 [0247.422] SetLastError (dwErrCode=0x0) [0247.422] GetLastError () returned 0x0 [0247.422] SetLastError (dwErrCode=0x0) [0247.422] GetLastError () returned 0x0 [0247.422] SetLastError (dwErrCode=0x0) [0247.422] GetLastError () returned 0x0 [0247.422] SetLastError (dwErrCode=0x0) [0247.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0247.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0247.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0247.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0247.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0247.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c3b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0247.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0247.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0247.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0247.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0247.422] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0247.423] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x302f608*=0xe63, lpOverlapped=0x0) returned 1 [0247.424] CloseHandle (hObject=0x5c0) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0247.424] CryptDestroyKey (hKey=0x52615c8) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39d00 | out: hHeap=0x310000) returned 1 [0247.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53525b0 | out: hHeap=0x310000) returned 1 [0247.424] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0247.425] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0247.425] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.425] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0247.426] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.426] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0247.426] CloseHandle (hObject=0x5c0) returned 1 [0247.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc2c8 [0247.426] RmStartSession () returned 0x0 [0247.427] RmRegisterResources () returned 0x0 [0247.428] RmGetList () returned 0x0 [0248.517] RmShutdown () returned 0x0 [0248.806] RmEndSession () returned 0x0 [0248.807] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261a48) returned 1 [0248.807] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0248.807] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0248.808] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0248.808] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0248.808] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=153) returned 1 [0248.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0248.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf0020 [0249.017] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0249.017] GetLastError () returned 0x0 [0249.017] SetLastError (dwErrCode=0x0) [0249.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.018] SetLastError (dwErrCode=0x0) [0249.018] GetLastError () returned 0x0 [0249.019] SetLastError (dwErrCode=0x0) [0249.019] GetLastError () returned 0x0 [0249.019] SetLastError (dwErrCode=0x0) [0249.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b688 [0249.019] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0249.019] GetLastError () returned 0x0 [0249.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0249.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c3b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.019] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b688 | out: hHeap=0x310000) returned 1 [0249.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0249.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0249.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0249.019] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0249.020] WriteFile (in: hFile=0x5c0, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x302f608*=0xe69, lpOverlapped=0x0) returned 1 [0249.021] CloseHandle (hObject=0x5c0) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc438 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f97a8 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0249.021] CryptDestroyKey (hKey=0x5261a48) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc2c8 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcb68 | out: hHeap=0x310000) returned 1 [0249.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353230 | out: hHeap=0x310000) returned 1 [0249.021] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0249.021] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0249.021] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.021] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0249.071] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.071] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0249.071] CloseHandle (hObject=0x5c0) returned 1 [0249.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a398 [0249.071] RmStartSession () returned 0x0 [0249.828] RmRegisterResources () returned 0x0 [0249.828] RmGetList () returned 0x0 [0249.934] RmShutdown () returned 0x0 [0250.703] RmEndSession () returned 0x0 [0250.703] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260e48) returned 1 [0250.704] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0250.704] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc", dwFileAttributes=0x20) returned 1 [0250.704] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0250.704] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0250.704] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=20109) returned 1 [0250.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0250.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b0c020 [0251.140] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0251.140] ReadFile (in: hFile=0x5e8, lpBuffer=0x7b0c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x7b0c040*, lpNumberOfBytesRead=0x302f694*=0x4e8d, lpOverlapped=0x0) returned 1 [0251.144] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0251.144] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0251.144] WriteFile (in: hFile=0x5e8, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0251.144] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0251.144] WriteFile (in: hFile=0x5e8, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0251.144] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x302f608*=0x2000) returned 1 [0251.144] WriteFile (in: hFile=0x5e8, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0251.144] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0251.144] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0251.145] WriteFile (in: hFile=0x5e8, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0251.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7b0c020 | out: hHeap=0x310000) returned 1 [0251.421] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bae030 | out: hHeap=0x310000) returned 1 [0251.421] CloseHandle (hObject=0x5e8) returned 1 [0251.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0251.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0251.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0251.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0251.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0251.422] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a410 [0251.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0251.422] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0251.422] GetLastError () returned 0x0 [0251.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0251.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c3b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.423] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f29c0 | out: hHeap=0x310000) returned 1 [0251.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0251.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0251.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0251.423] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0251.429] WriteFile (in: hFile=0x5e8, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x302f608*=0xe70, lpOverlapped=0x0) returned 1 [0251.430] CloseHandle (hObject=0x5e8) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0251.431] CryptDestroyKey (hKey=0x5260e48) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a398 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39df0 | out: hHeap=0x310000) returned 1 [0251.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353190 | out: hHeap=0x310000) returned 1 [0251.431] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0251.431] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0251.431] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.431] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0251.433] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.433] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0251.433] CloseHandle (hObject=0x5e8) returned 1 [0251.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0251.433] RmStartSession () returned 0x0 [0251.434] RmRegisterResources () returned 0x0 [0251.435] RmGetList () returned 0x0 [0251.490] RmShutdown () returned 0x0 [0253.508] RmEndSession () returned 0x0 [0253.511] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52612c8) returned 1 [0253.511] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0253.512] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties", dwFileAttributes=0x20) returned 1 [0253.512] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0253.512] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0253.512] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=4464) returned 1 [0253.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0253.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7895020 [0253.530] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0253.530] ReadFile (in: hFile=0x5e8, lpBuffer=0x7895040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x7895040*, lpNumberOfBytesRead=0x302f694*=0x1170, lpOverlapped=0x0) returned 1 [0253.656] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0253.656] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0253.656] WriteFile (in: hFile=0x5e8, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0253.656] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0253.656] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0253.656] WriteFile (in: hFile=0x5e8, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0253.656] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7895020 | out: hHeap=0x310000) returned 1 [0253.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0253.663] CloseHandle (hObject=0x5e8) returned 1 [0253.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0253.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0253.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0253.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0253.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0253.663] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0253.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0253.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0253.664] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0253.664] GetLastError () returned 0x0 [0253.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x302f4d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0253.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0253.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0253.664] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0253.665] WriteFile (in: hFile=0x5e8, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x302f608*=0xe57, lpOverlapped=0x0) returned 1 [0253.666] CloseHandle (hObject=0x5e8) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0253.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0253.667] CryptDestroyKey (hKey=0x52612c8) returned 1 [0253.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0253.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39670 | out: hHeap=0x310000) returned 1 [0253.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352bf0 | out: hHeap=0x310000) returned 1 [0253.667] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0253.667] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0253.667] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 0 [0253.667] CloseHandle (hObject=0x5e8) returned 1 [0253.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0253.667] RmStartSession () returned 0x0 [0253.670] RmRegisterResources () returned 0x0 [0253.671] RmGetList () returned 0x0 [0253.986] RmShutdown () returned 0x0 [0255.114] RmEndSession () returned 0x0 [0255.115] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260e08) returned 1 [0255.115] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries")) returned 0x20 [0255.115] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries", dwFileAttributes=0x20) returned 1 [0255.116] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0255.116] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0255.116] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=0) returned 1 [0255.116] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0255.116] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7acc020 [0255.811] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0255.811] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0255.812] WriteFile (in: hFile=0x5e8, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0255.812] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7acc020 | out: hHeap=0x310000) returned 1 [0257.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bb4078 | out: hHeap=0x310000) returned 1 [0257.472] CloseHandle (hObject=0x5e8) returned 1 [0257.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0257.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0257.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0257.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0257.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0257.473] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries.bdcddcbaad"), dwFlags=0x1) returned 1 [0257.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0257.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d199c0 [0257.473] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0257.473] GetLastError () returned 0x0 [0257.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0257.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0257.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c3b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0257.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0257.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0257.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0257.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0257.474] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0257.475] WriteFile (in: hFile=0x5e8, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe64, lpOverlapped=0x0) returned 1 [0257.475] CloseHandle (hObject=0x5e8) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d199c0 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0257.476] CryptDestroyKey (hKey=0x5260e08) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x556ff18 | out: hHeap=0x310000) returned 1 [0257.476] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53536e0 | out: hHeap=0x310000) returned 1 [0257.476] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0257.476] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0257.478] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.478] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0257.481] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.481] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0257.481] CloseHandle (hObject=0x5e8) returned 1 [0257.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0adf8 [0257.481] RmStartSession () returned 0x0 [0257.483] RmRegisterResources () returned 0x0 [0257.483] RmGetList () returned 0x0 [0257.506] RmShutdown () returned 0x0 [0258.177] RmEndSession () returned 0x0 [0258.178] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261388) returned 1 [0258.178] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0258.178] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0258.178] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0258.178] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0258.178] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=387356) returned 1 [0258.178] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0258.178] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f3020 [0259.888] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0259.888] GetLastError () returned 0x0 [0259.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0259.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0259.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x38c160, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", lpUsedDefaultChar=0x0) returned 26 [0259.889] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x610ec30 | out: hHeap=0x310000) returned 1 [0259.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0259.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0259.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0259.889] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0259.891] WriteFile (in: hFile=0x5e8, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x302f608*=0xe6d, lpOverlapped=0x0) returned 1 [0259.892] CloseHandle (hObject=0x5e8) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05188 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539dd00 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f050a0 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0259.892] CryptDestroyKey (hKey=0x5261388) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0adf8 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9ba0 | out: hHeap=0x310000) returned 1 [0259.892] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351890 | out: hHeap=0x310000) returned 1 [0259.892] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0259.892] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0259.895] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.895] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0260.019] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.019] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0260.019] CloseHandle (hObject=0x500) returned 1 [0260.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f056f8 [0260.019] RmStartSession () returned 0x0 [0260.020] RmRegisterResources () returned 0x0 [0260.021] RmGetList () returned 0x0 [0260.049] RmShutdown () returned 0x0 [0260.675] RmEndSession () returned 0x0 [0260.823] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5260c48) returned 1 [0260.823] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0260.823] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0260.824] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0260.824] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0260.824] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=19451) returned 1 [0260.824] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0260.824] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c20020 [0261.547] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0261.547] GetLastError () returned 0x0 [0261.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0261.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0261.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c390, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0261.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6107750 | out: hHeap=0x310000) returned 1 [0261.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0261.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0261.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0261.549] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0261.549] WriteFile (in: hFile=0x680, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x302f608*=0xe71, lpOverlapped=0x0) returned 1 [0261.550] CloseHandle (hObject=0x680) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0261.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f058c8 | out: hHeap=0x310000) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f158 | out: hHeap=0x310000) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04790 | out: hHeap=0x310000) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0261.551] CryptDestroyKey (hKey=0x5260c48) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f056f8 | out: hHeap=0x310000) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9548 | out: hHeap=0x310000) returned 1 [0261.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352010 | out: hHeap=0x310000) returned 1 [0261.551] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0261.551] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0261.551] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.551] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0261.552] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.552] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0261.552] CloseHandle (hObject=0x680) returned 1 [0261.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f04c18 [0261.553] RmStartSession () returned 0x0 [0261.769] RmRegisterResources () returned 0x0 [0261.770] RmGetList () returned 0x0 [0261.852] RmShutdown () returned 0x0 [0263.606] RmEndSession () returned 0x0 [0263.607] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52612c8) returned 1 [0263.607] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0263.607] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0263.607] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0263.607] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0263.607] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=14913) returned 1 [0263.607] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0265.702] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0265.702] GetLastError () returned 0x0 [0265.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0265.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x302f4d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0265.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0265.702] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0265.702] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0265.702] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0265.702] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0265.703] WriteFile (in: hFile=0x694, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe61, lpOverlapped=0x0) returned 1 [0265.704] CloseHandle (hObject=0x694) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0d38 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05610 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539a7b8 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04878 | out: hHeap=0x310000) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0265.704] CryptDestroyKey (hKey=0x52612c8) returned 1 [0265.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04c18 | out: hHeap=0x310000) returned 1 [0265.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348098 | out: hHeap=0x310000) returned 1 [0265.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351cf0 | out: hHeap=0x310000) returned 1 [0265.705] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0265.705] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0265.705] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.705] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0265.709] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.709] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0265.709] CloseHandle (hObject=0x694) returned 1 [0265.710] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f05610 [0265.710] RmStartSession () returned 0x0 [0265.765] RmRegisterResources () returned 0x0 [0265.765] RmGetList () returned 0x0 [0265.895] RmShutdown () returned 0x0 [0266.177] RmEndSession () returned 0x0 [0266.178] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261788) returned 1 [0266.178] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0266.178] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0266.178] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0266.178] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0266.178] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=1261) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0266.178] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e8020 [0267.388] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0267.388] GetLastError () returned 0x0 [0267.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0267.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0267.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x38c520, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pvosW60j6t7if2aYH", lpUsedDefaultChar=0x0) returned 17 [0267.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0267.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0267.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0267.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0267.389] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0267.390] WriteFile (in: hFile=0x630, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe64, lpOverlapped=0x0) returned 1 [0267.391] CloseHandle (hObject=0x630) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f440 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0267.391] CryptDestroyKey (hKey=0x5261788) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05610 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348438 | out: hHeap=0x310000) returned 1 [0267.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19240 | out: hHeap=0x310000) returned 1 [0267.391] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0267.391] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0267.391] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.391] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0267.427] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.427] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0267.427] CloseHandle (hObject=0x630) returned 1 [0267.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0267.427] RmStartSession () returned 0x0 [0267.430] RmRegisterResources () returned 0x0 [0267.433] RmGetList () returned 0x0 [0267.823] RmShutdown () returned 0x0 [0269.643] RmEndSession () returned 0x0 [0269.866] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261988) returned 1 [0269.866] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0269.866] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF", dwFileAttributes=0x220) returned 1 [0269.867] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0269.867] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0269.867] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=3251) returned 1 [0269.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0269.887] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0269.887] GetLastError () returned 0x0 [0269.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0269.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0269.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c480, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0269.888] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e895f0 | out: hHeap=0x310000) returned 1 [0269.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0269.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0269.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0269.888] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0269.889] WriteFile (in: hFile=0x500, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x302f608*=0xe6e, lpOverlapped=0x0) returned 1 [0269.890] CloseHandle (hObject=0x500) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0269.890] CryptDestroyKey (hKey=0x5261988) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570768 | out: hHeap=0x310000) returned 1 [0269.890] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5da0 | out: hHeap=0x310000) returned 1 [0269.890] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0269.890] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0269.896] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.896] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0269.902] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.902] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0269.902] CloseHandle (hObject=0x500) returned 1 [0269.902] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0269.902] RmStartSession () returned 0x0 [0269.905] RmRegisterResources () returned 0x0 [0269.909] RmGetList () returned 0x0 [0271.017] RmShutdown () returned 0x0 [0271.682] RmEndSession () returned 0x0 [0271.683] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261908) returned 1 [0271.683] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0271.683] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF", dwFileAttributes=0x220) returned 1 [0271.683] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0271.683] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0271.683] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=15308) returned 1 [0271.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b29e38 [0271.707] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0271.707] GetLastError () returned 0x0 [0271.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0271.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x302f4d0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bY", lpUsedDefaultChar=0x0) returned 2 [0271.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0271.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0271.708] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0271.709] WriteFile (in: hFile=0x500, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x302f608*=0xe55, lpOverlapped=0x0) returned 1 [0271.710] CloseHandle (hObject=0x500) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc940 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0271.710] CryptDestroyKey (hKey=0x5261908) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0271.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2d70 | out: hHeap=0x310000) returned 1 [0271.710] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0271.710] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0271.710] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.710] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0271.712] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.712] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0271.712] CloseHandle (hObject=0x500) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0271.713] RmStartSession () returned 0x0 [0271.714] RmRegisterResources () returned 0x0 [0271.715] RmGetList () returned 0x0 [0274.734] RmShutdown () returned 0x0 [0275.748] RmEndSession () returned 0x0 [0275.749] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261388) returned 1 [0275.749] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0275.749] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF", dwFileAttributes=0x220) returned 1 [0275.749] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0275.750] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0275.750] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=5375) returned 1 [0275.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0275.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ea020 [0276.717] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0276.717] GetLastError () returned 0x0 [0276.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0276.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0276.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x38c480, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terRLaOJV2Dtqoxu0p", lpUsedDefaultChar=0x0) returned 18 [0276.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0276.718] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0276.718] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0276.718] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0276.718] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0276.719] WriteFile (in: hFile=0x500, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe65, lpOverlapped=0x0) returned 1 [0276.719] CloseHandle (hObject=0x500) returned 1 [0276.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0276.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0276.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0276.720] CryptDestroyKey (hKey=0x5261388) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4ee0 | out: hHeap=0x310000) returned 1 [0276.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2e10 | out: hHeap=0x310000) returned 1 [0276.720] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0276.720] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0276.720] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.720] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0276.732] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.736] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0276.736] CloseHandle (hObject=0x500) returned 1 [0276.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0276.737] RmStartSession () returned 0x0 [0276.738] RmRegisterResources () returned 0x0 [0276.739] RmGetList () returned 0x0 [0276.760] RmShutdown () returned 0x0 [0277.486] RmEndSession () returned 0x0 [0277.487] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261a08) returned 1 [0277.487] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0277.487] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF", dwFileAttributes=0x220) returned 1 [0277.488] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0277.488] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0277.488] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=3012) returned 1 [0277.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0277.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0278.182] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0278.182] ReadFile (in: hFile=0x500, lpBuffer=0x6219040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6219040*, lpNumberOfBytesRead=0x302f694*=0xbc4, lpOverlapped=0x0) returned 1 [0278.182] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0278.182] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0278.182] WriteFile (in: hFile=0x500, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0278.183] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0278.183] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0278.183] WriteFile (in: hFile=0x500, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0278.183] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6219020 | out: hHeap=0x310000) returned 1 [0279.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0279.062] CloseHandle (hObject=0x500) returned 1 [0279.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0279.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0279.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0279.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0279.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0279.062] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0279.063] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0279.063] GetLastError () returned 0x0 [0279.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0279.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x38c3e0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5PaBVzxQBGd15AjyqsacvL0n", lpUsedDefaultChar=0x0) returned 24 [0279.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7b950 | out: hHeap=0x310000) returned 1 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0279.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0279.064] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0279.064] WriteFile (in: hFile=0x500, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe6b, lpOverlapped=0x0) returned 1 [0279.065] CloseHandle (hObject=0x500) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0279.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0279.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0279.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0279.066] CryptDestroyKey (hKey=0x5261a08) returned 1 [0279.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0279.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6998 | out: hHeap=0x310000) returned 1 [0279.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2000 | out: hHeap=0x310000) returned 1 [0279.066] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0279.066] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0279.066] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.066] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0279.078] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.078] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0279.078] CloseHandle (hObject=0x500) returned 1 [0279.078] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0279.078] RmStartSession () returned 0x0 [0279.079] RmRegisterResources () returned 0x0 [0279.079] RmGetList () returned 0x0 [0279.125] RmShutdown () returned 0x0 [0280.035] RmEndSession () returned 0x0 [0280.036] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261208) returned 1 [0280.036] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0280.036] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF", dwFileAttributes=0x220) returned 1 [0280.036] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0280.036] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0280.036] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=7668) returned 1 [0280.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0280.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6218020 [0280.503] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0280.503] ReadFile (in: hFile=0x500, lpBuffer=0x6218040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6218040*, lpNumberOfBytesRead=0x302f694*=0x1df4, lpOverlapped=0x0) returned 1 [0280.504] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0280.504] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0280.504] WriteFile (in: hFile=0x500, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0280.504] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0280.504] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0280.505] WriteFile (in: hFile=0x500, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0280.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6218020 | out: hHeap=0x310000) returned 1 [0280.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b47008 | out: hHeap=0x310000) returned 1 [0280.548] CloseHandle (hObject=0x500) returned 1 [0280.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0280.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0280.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.548] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4120 [0280.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0280.549] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0280.549] GetLastError () returned 0x0 [0280.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0280.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c160, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e80450 | out: hHeap=0x310000) returned 1 [0280.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0280.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0280.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.550] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0280.551] WriteFile (in: hFile=0x500, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe6f, lpOverlapped=0x0) returned 1 [0280.551] CloseHandle (hObject=0x500) returned 1 [0280.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0280.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4120 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.552] CryptDestroyKey (hKey=0x5261208) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95050 | out: hHeap=0x310000) returned 1 [0280.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2140 | out: hHeap=0x310000) returned 1 [0280.552] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0280.552] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0280.552] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.552] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0280.563] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.564] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0280.564] CloseHandle (hObject=0x500) returned 1 [0280.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0280.564] RmStartSession () returned 0x0 [0280.689] RmRegisterResources () returned 0x0 [0280.690] RmGetList () returned 0x0 [0280.762] RmShutdown () returned 0x0 [0281.604] RmEndSession () returned 0x0 [0281.605] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x35d848) returned 1 [0281.605] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0281.605] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF", dwFileAttributes=0x220) returned 1 [0281.605] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0281.605] CryptEncrypt (in: hKey=0x35d848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0281.605] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=3348) returned 1 [0281.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0281.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56fd020 [0282.212] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0282.212] ReadFile (in: hFile=0x664, lpBuffer=0x56fd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x56fd040*, lpNumberOfBytesRead=0x302f694*=0xd14, lpOverlapped=0x0) returned 1 [0282.213] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0282.213] CryptEncrypt (in: hKey=0x35d848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x302f608*=0x2000) returned 1 [0282.213] WriteFile (in: hFile=0x664, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0282.213] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0282.213] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0282.213] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0282.213] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56fd020 | out: hHeap=0x310000) returned 1 [0282.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0282.332] CloseHandle (hObject=0x664) returned 1 [0282.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0282.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0282.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b41b8 [0282.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0282.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0282.332] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0282.333] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0282.333] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0282.333] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0282.334] GetLastError () returned 0x0 [0282.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0282.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x302f4d0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fl", lpUsedDefaultChar=0x0) returned 2 [0282.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0282.334] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0282.335] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0282.335] WriteFile (in: hFile=0x664, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe55, lpOverlapped=0x0) returned 1 [0282.336] CloseHandle (hObject=0x664) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0282.336] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0282.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0282.337] CryptDestroyKey (hKey=0x35d848) returned 1 [0282.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0282.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94470 | out: hHeap=0x310000) returned 1 [0282.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1e70 | out: hHeap=0x310000) returned 1 [0282.337] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0282.337] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0282.337] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.337] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0282.371] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.371] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0282.371] CloseHandle (hObject=0x664) returned 1 [0282.371] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0282.371] RmStartSession () returned 0x0 [0282.373] RmRegisterResources () returned 0x0 [0282.378] RmGetList () returned 0x0 [0284.409] RmShutdown () returned 0x0 [0285.862] RmEndSession () returned 0x0 [0285.863] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x52616c8) returned 1 [0285.863] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0285.863] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF", dwFileAttributes=0x220) returned 1 [0285.863] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0285.864] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0285.864] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=28948) returned 1 [0285.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0285.864] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x780a020 [0285.882] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0285.882] ReadFile (in: hFile=0x664, lpBuffer=0x780a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x780a040*, lpNumberOfBytesRead=0x302f694*=0x7114, lpOverlapped=0x0) returned 1 [0286.112] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0286.112] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0286.112] WriteFile (in: hFile=0x664, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0286.112] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0286.112] WriteFile (in: hFile=0x664, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0286.112] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0286.112] WriteFile (in: hFile=0x664, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0286.112] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0286.113] WriteFile (in: hFile=0x664, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0286.113] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0286.113] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0286.113] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0286.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x780a020 | out: hHeap=0x310000) returned 1 [0286.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0286.120] CloseHandle (hObject=0x664) returned 1 [0286.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0286.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c16e8 [0286.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b41b8 [0286.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0286.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c16e8 | out: hHeap=0x310000) returned 1 [0286.120] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0286.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0286.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0286.121] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0286.121] GetLastError () returned 0x0 [0286.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0286.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x302f4d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aGphKsS54ZcVf9i", lpUsedDefaultChar=0x0) returned 15 [0286.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0286.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0286.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0286.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0286.122] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0286.123] WriteFile (in: hFile=0x664, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x302f608*=0xe62, lpOverlapped=0x0) returned 1 [0286.124] CloseHandle (hObject=0x664) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0286.125] CryptDestroyKey (hKey=0x52616c8) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94a60 | out: hHeap=0x310000) returned 1 [0286.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e25a0 | out: hHeap=0x310000) returned 1 [0286.125] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0286.125] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0286.125] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.125] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0286.167] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.167] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0286.167] CloseHandle (hObject=0x664) returned 1 [0286.167] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0286.167] RmStartSession () returned 0x0 [0286.170] RmRegisterResources () returned 0x0 [0286.171] RmGetList () returned 0x0 [0286.281] RmShutdown () returned 0x0 [0288.845] RmEndSession () returned 0x0 [0288.847] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x5261ac8) returned 1 [0288.847] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0288.847] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF", dwFileAttributes=0x220) returned 1 [0288.847] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0288.847] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0288.847] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=7966) returned 1 [0288.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4ba7380 [0288.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0289.208] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0289.208] ReadFile (in: hFile=0x664, lpBuffer=0x6219040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x6219040*, lpNumberOfBytesRead=0x302f694*=0x1f1e, lpOverlapped=0x0) returned 1 [0289.209] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0289.209] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x302f608*=0x2000) returned 1 [0289.209] WriteFile (in: hFile=0x664, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0289.210] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0289.210] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0289.210] WriteFile (in: hFile=0x664, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0289.210] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6219020 | out: hHeap=0x310000) returned 1 [0289.417] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba7380 | out: hHeap=0x310000) returned 1 [0289.417] CloseHandle (hObject=0x664) returned 1 [0289.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0289.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3fe0 [0289.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a53a0 [0289.417] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4938 [0289.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3fe0 | out: hHeap=0x310000) returned 1 [0289.418] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a57c8 [0289.419] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.419] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0289.419] GetLastError () returned 0x0 [0289.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0289.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0289.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x38c3b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ac9GKTK0aPkhGvcK4dkln2M2j", lpUsedDefaultChar=0x0) returned 25 [0289.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e0a0 | out: hHeap=0x310000) returned 1 [0289.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0289.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0289.420] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.420] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0289.421] WriteFile (in: hFile=0x664, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x302f608*=0xe6c, lpOverlapped=0x0) returned 1 [0289.422] CloseHandle (hObject=0x664) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a57c8 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4938 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a53a0 | out: hHeap=0x310000) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0289.422] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0289.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0289.423] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95808 | out: hHeap=0x310000) returned 1 [0289.423] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2690 | out: hHeap=0x310000) returned 1 [0289.423] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0289.423] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0289.423] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.423] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0289.438] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.438] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0289.439] CloseHandle (hObject=0x664) returned 1 [0289.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5d20 [0289.439] RmStartSession () returned 0x0 [0290.252] RmRegisterResources () returned 0x0 [0290.252] RmGetList () returned 0x0 [0290.439] RmShutdown () returned 0x0 [0291.620] RmEndSession () returned 0x0 [0291.621] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x302f794 | out: phKey=0x302f794*=0x35db08) returned 1 [0291.621] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0291.621] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF", dwFileAttributes=0x220) returned 1 [0291.621] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0291.622] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x302f5f4*=0x2000) returned 1 [0291.622] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x302f68c | out: lpFileSize=0x302f68c*=9818) returned 1 [0291.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x609c008 [0291.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64ba020 [0292.305] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0292.305] ReadFile (in: hFile=0x6ac, lpBuffer=0x64ba040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x64ba040*, lpNumberOfBytesRead=0x302f694*=0x265a, lpOverlapped=0x0) returned 1 [0292.306] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f67c | out: lpNewFilePointer=0x0) returned 1 [0292.306] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x609c020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x609c020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0292.306] WriteFile (in: hFile=0x6ac, lpBuffer=0x609c020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x609c020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0292.306] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x609c020*, pdwDataLen=0x302f608*=0x2000, dwBufLen=0x2000 | out: pbData=0x609c020*, pdwDataLen=0x302f608*=0x2000) returned 1 [0292.306] WriteFile (in: hFile=0x6ac, lpBuffer=0x609c020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x609c020*, lpNumberOfBytesWritten=0x302f698*=0x2000, lpOverlapped=0x0) returned 1 [0292.307] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302f684 | out: lpNewFilePointer=0x0) returned 1 [0292.307] WriteFile (in: hFile=0x6ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x302f698*=0x200, lpOverlapped=0x0) returned 1 [0292.307] WriteFile (in: hFile=0x6ac, lpBuffer=0x302f634*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x302f698, lpOverlapped=0x0 | out: lpBuffer=0x302f634*, lpNumberOfBytesWritten=0x302f698*=0x18, lpOverlapped=0x0) returned 1 [0292.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64ba020 | out: hHeap=0x310000) returned 1 [0292.579] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x609c008 | out: hHeap=0x310000) returned 1 [0292.579] CloseHandle (hObject=0x6ac) returned 1 [0292.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0292.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3688 [0292.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0292.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5ec8 [0292.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3688 | out: hHeap=0x310000) returned 1 [0292.580] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a54d0 [0292.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0292.581] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x302f468 | out: lpSystemTimeAsFileTime=0x302f468) [0292.581] GetLastError () returned 0x0 [0292.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x302f4d0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0292.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.581] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0292.582] WriteFile (in: hFile=0x6ac, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x302f608, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x302f608*=0xe56, lpOverlapped=0x0) returned 1 [0292.583] CloseHandle (hObject=0x6ac) returned 1 [0292.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0292.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0292.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a54d0 | out: hHeap=0x310000) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5ec8 | out: hHeap=0x310000) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0292.584] CryptDestroyKey (hKey=0x35db08) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5d20 | out: hHeap=0x310000) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95c30 | out: hHeap=0x310000) returned 1 [0292.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5800 | out: hHeap=0x310000) returned 1 [0292.584] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x302f7c8, lpCompletionKey=0x302f7cc, lpOverlapped=0x302f7c4) returned 1 [0292.585] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0292.585] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f698 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.585] ReadFile (in: hFile=0x6ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f694, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f694*=0x18, lpOverlapped=0x0) returned 1 [0292.616] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302f6a0 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.616] ReadFile (in: hFile=0x6ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x302f688, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x302f688*=0x18, lpOverlapped=0x0) returned 1 [0292.616] CloseHandle (hObject=0x6ac) returned 1 [0292.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a54d0 [0292.616] RmStartSession () returned 0x0 [0292.929] RmRegisterResources () returned 0x0 [0293.030] RmGetList () returned 0x0 [0293.062] RmShutdown () Thread: id = 7 os_tid = 0xff0 [0068.586] GetLastError () returned 0x57 [0068.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x348470 [0068.586] SetLastError (dwErrCode=0x57) [0068.586] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0086.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0088.603] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0090.083] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0091.086] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0093.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0111.933] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0116.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0127.651] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0128.725] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0135.315] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0135.605] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.605] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0135.607] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.608] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0135.608] CloseHandle (hObject=0x5b8) returned 1 [0135.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0135.608] RmStartSession () returned 0x0 [0136.881] RmRegisterResources () returned 0x0 [0136.892] RmGetList () returned 0x0 [0137.490] RmShutdown () returned 0x0 [0139.594] RmEndSession () returned 0x0 [0139.595] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x35d908) returned 1 [0139.595] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0139.595] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.595] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0139.595] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0139.595] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=6309) returned 1 [0139.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0139.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6666020 [0139.947] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0139.947] ReadFile (in: hFile=0x5d8, lpBuffer=0x6666040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6666040*, lpNumberOfBytesRead=0x316fca4*=0x18a5, lpOverlapped=0x0) returned 1 [0139.949] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0139.949] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0139.949] WriteFile (in: hFile=0x5d8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0139.949] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0139.949] WriteFile (in: hFile=0x5d8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0139.949] WriteFile (in: hFile=0x5d8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0139.949] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6666020 | out: hHeap=0x310000) returned 1 [0141.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0141.704] CloseHandle (hObject=0x5d8) returned 1 [0141.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0141.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0141.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0141.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0141.707] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0141.707] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1028\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0141.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0141.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.748] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0141.748] GetLastError () returned 0x0 [0141.748] SetLastError (dwErrCode=0x0) [0141.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365198 [0141.748] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.749] SetLastError (dwErrCode=0x0) [0141.749] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0141.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18b10 [0141.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0141.750] GetLastError () returned 0x0 [0141.750] SetLastError (dwErrCode=0x0) [0141.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365198 | out: hHeap=0x310000) returned 1 [0141.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0141.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0141.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x38c4d0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o3YUTB6kWZJFeepfmCEnbwyP1", lpUsedDefaultChar=0x0) returned 25 [0141.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18b10 | out: hHeap=0x310000) returned 1 [0141.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0141.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5eb4088 [0141.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0141.751] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0141.751] WriteFile (in: hFile=0x6a8, lpBuffer=0x5eb4088*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x5eb4088*, lpNumberOfBytesWritten=0x316fc18*=0xe6c, lpOverlapped=0x0) returned 1 [0141.752] CloseHandle (hObject=0x6a8) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5eb4088 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0141.753] CryptDestroyKey (hKey=0x35d908) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399140 | out: hHeap=0x310000) returned 1 [0141.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a98 | out: hHeap=0x310000) returned 1 [0141.753] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0141.754] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0141.754] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.754] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0141.769] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.769] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0141.769] CloseHandle (hObject=0x6a8) returned 1 [0141.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2518 [0141.769] RmStartSession () returned 0x0 [0141.772] RmRegisterResources () returned 0x0 [0141.777] RmGetList () returned 0x0 [0143.581] RmShutdown () returned 0x0 [0145.866] RmEndSession () returned 0x0 [0145.936] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261308) returned 1 [0145.936] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0145.936] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0145.936] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0145.936] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0145.936] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=72076) returned 1 [0145.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12090 [0145.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c7020 [0145.958] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0145.958] ReadFile (in: hFile=0x6a8, lpBuffer=0x58c7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x58c7040*, lpNumberOfBytesRead=0x316fca4*=0x1198c, lpOverlapped=0x0) returned 1 [0145.995] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.996] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.997] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.997] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0145.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0145.997] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0145.997] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c7020 | out: hHeap=0x310000) returned 1 [0148.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12090 | out: hHeap=0x310000) returned 1 [0148.391] CloseHandle (hObject=0x6a8) returned 1 [0148.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0148.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb8a8 [0148.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0148.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0148.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0148.394] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1037\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0148.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0148.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0148.394] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0148.394] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb2d0 [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.395] GetLastError () returned 0x0 [0148.395] SetLastError (dwErrCode=0x0) [0148.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb2d0 | out: hHeap=0x310000) returned 1 [0148.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x316fae0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmgdxOo64GZeM", lpUsedDefaultChar=0x0) returned 13 [0148.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0148.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0148.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0148.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0148.396] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1037\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0148.397] WriteFile (in: hFile=0x6a8, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x316fc18*=0xe60, lpOverlapped=0x0) returned 1 [0148.398] CloseHandle (hObject=0x6a8) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0148.398] CryptDestroyKey (hKey=0x5261308) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2518 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d18 | out: hHeap=0x310000) returned 1 [0148.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e30 | out: hHeap=0x310000) returned 1 [0148.398] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0148.398] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0148.399] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.399] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0148.462] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.462] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0148.462] CloseHandle (hObject=0x6a8) returned 1 [0148.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1e98 [0148.462] RmStartSession () returned 0x0 [0148.465] RmRegisterResources () returned 0x0 [0148.469] RmGetList () returned 0x0 [0148.777] RmShutdown () returned 0x0 [0149.757] RmEndSession () returned 0x0 [0149.758] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260cc8) returned 1 [0149.758] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0149.758] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0149.759] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0149.759] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0149.759] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=60816) returned 1 [0149.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0149.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6848020 [0149.996] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0149.997] ReadFile (in: hFile=0x6a8, lpBuffer=0x6848040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6848040*, lpNumberOfBytesRead=0x316fca4*=0xed90, lpOverlapped=0x0) returned 1 [0150.003] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0150.003] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.003] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.003] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0150.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0150.004] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0150.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0150.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0150.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6848020 | out: hHeap=0x310000) returned 1 [0150.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0150.082] CloseHandle (hObject=0x6a8) returned 1 [0150.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0150.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0150.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0150.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3780 [0150.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0150.084] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\3076\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0150.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980b0 [0150.085] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3670 [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] GetLastError () returned 0x0 [0150.085] SetLastError (dwErrCode=0x0) [0150.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0150.085] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0150.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] GetLastError () returned 0x0 [0150.086] SetLastError (dwErrCode=0x0) [0150.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3670 | out: hHeap=0x310000) returned 1 [0150.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0150.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x38c4d0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9XOqcHODkUzIb3wxAPZ", lpUsedDefaultChar=0x0) returned 19 [0150.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0150.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0150.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0150.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39b20 [0150.087] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0150.089] WriteFile (in: hFile=0x6a8, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x316fc18*=0xe66, lpOverlapped=0x0) returned 1 [0150.090] CloseHandle (hObject=0x6a8) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39b20 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980b0 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3780 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0150.090] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060630 | out: hHeap=0x310000) returned 1 [0150.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19920 | out: hHeap=0x310000) returned 1 [0150.090] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0150.090] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0150.091] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.091] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0150.127] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.127] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0150.127] CloseHandle (hObject=0x6a8) returned 1 [0150.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a30 [0150.127] RmStartSession () returned 0x0 [0150.238] RmRegisterResources () returned 0x0 [0150.241] RmGetList () returned 0x0 [0150.471] RmShutdown () returned 0x0 [0151.722] RmEndSession () returned 0x0 [0151.723] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261248) returned 1 [0151.723] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0151.723] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico", dwFileAttributes=0x80) returned 1 [0151.723] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0151.723] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0151.723] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=88533) returned 1 [0151.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e58e0 [0151.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x683b020 [0151.927] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0151.927] ReadFile (in: hFile=0x6a8, lpBuffer=0x683b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x683b040*, lpNumberOfBytesRead=0x316fca4*=0x159d5, lpOverlapped=0x0) returned 1 [0151.933] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0151.933] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.933] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.933] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.933] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.933] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.933] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.933] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.933] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.933] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.933] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.934] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0151.934] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0151.935] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0151.935] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0151.935] WriteFile (in: hFile=0x6a8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0151.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x683b020 | out: hHeap=0x310000) returned 1 [0151.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e58e0 | out: hHeap=0x310000) returned 1 [0151.942] CloseHandle (hObject=0x6a8) returned 1 [0151.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0151.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0151.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0151.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0900 [0151.945] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0151.945] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0151.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0151.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b928 [0151.945] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.946] SetLastError (dwErrCode=0x0) [0151.946] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b538 [0151.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5351ed0 [0151.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b538 | out: hHeap=0x310000) returned 1 [0151.947] GetLastError () returned 0x0 [0151.947] SetLastError (dwErrCode=0x0) [0151.947] GetLastError () returned 0x0 [0151.948] SetLastError (dwErrCode=0x0) [0151.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0151.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0151.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0151.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x38c160, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sHbaIgxKQiPPpPi01TvxwcKf8q", lpUsedDefaultChar=0x0) returned 26 [0151.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351ed0 | out: hHeap=0x310000) returned 1 [0151.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0151.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0151.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0151.948] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0151.948] WriteFile (in: hFile=0x6a8, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x316fc18*=0xe6d, lpOverlapped=0x0) returned 1 [0151.949] CloseHandle (hObject=0x6a8) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b928 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0151.950] CryptDestroyKey (hKey=0x5261248) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a30 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e53c0 | out: hHeap=0x310000) returned 1 [0151.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19600 | out: hHeap=0x310000) returned 1 [0151.950] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0151.950] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0151.951] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.951] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0151.997] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.997] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0151.997] CloseHandle (hObject=0x6a8) returned 1 [0151.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0151.997] RmStartSession () returned 0x0 [0152.107] RmRegisterResources () returned 0x0 [0152.112] RmGetList () returned 0x0 [0152.515] RmShutdown () returned 0x0 [0153.135] RmEndSession () returned 0x0 [0153.136] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260e88) returned 1 [0153.136] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0153.136] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico", dwFileAttributes=0x80) returned 1 [0153.136] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0153.136] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0153.136] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=894) returned 1 [0153.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0153.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6836020 [0153.520] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0153.520] ReadFile (in: hFile=0x6a8, lpBuffer=0x6836040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6836040*, lpNumberOfBytesRead=0x316fca4*=0x37e, lpOverlapped=0x0) returned 1 [0153.521] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0153.521] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0153.521] WriteFile (in: hFile=0x6a8, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0153.521] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0153.522] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0153.522] WriteFile (in: hFile=0x6a8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0153.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6836020 | out: hHeap=0x310000) returned 1 [0153.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0153.618] CloseHandle (hObject=0x6a8) returned 1 [0153.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0153.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0360 [0153.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0153.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0153.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0153.620] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0153.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2240 [0153.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0153.620] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0153.620] GetLastError () returned 0x0 [0153.620] SetLastError (dwErrCode=0x0) [0153.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0153.620] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.621] SetLastError (dwErrCode=0x0) [0153.621] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0153.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x53519d0 [0153.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.622] SetLastError (dwErrCode=0x0) [0153.622] GetLastError () returned 0x0 [0153.623] SetLastError (dwErrCode=0x0) [0153.623] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0153.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0153.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0153.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x38c4d0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", lpUsedDefaultChar=0x0) returned 29 [0153.623] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53519d0 | out: hHeap=0x310000) returned 1 [0153.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0153.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x4ba9660 [0153.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0153.623] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0153.623] WriteFile (in: hFile=0x6a8, lpBuffer=0x4ba9660*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4ba9660*, lpNumberOfBytesWritten=0x316fc18*=0xe70, lpOverlapped=0x0) returned 1 [0153.624] CloseHandle (hObject=0x6a8) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9660 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2240 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0153.625] CryptDestroyKey (hKey=0x5260e88) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060560 | out: hHeap=0x310000) returned 1 [0153.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5da0 | out: hHeap=0x310000) returned 1 [0153.625] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0153.625] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0153.625] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.625] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0153.649] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.649] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0153.649] CloseHandle (hObject=0x6a8) returned 1 [0153.649] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0153.649] RmStartSession () returned 0x0 [0153.940] RmRegisterResources () returned 0x0 [0153.944] RmGetList () returned 0x0 [0154.375] RmShutdown () returned 0x0 [0158.158] RmEndSession () returned 0x0 [0158.158] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261008) returned 1 [0158.159] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0158.159] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", dwFileAttributes=0x80) returned 1 [0158.159] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0158.159] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0158.159] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=1150) returned 1 [0158.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0158.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6bfe020 [0158.592] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0158.592] ReadFile (in: hFile=0x4e4, lpBuffer=0x6bfe040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6bfe040*, lpNumberOfBytesRead=0x316fca4*=0x47e, lpOverlapped=0x0) returned 1 [0158.593] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0158.593] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0158.594] WriteFile (in: hFile=0x4e4, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0158.594] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0158.594] WriteFile (in: hFile=0x4e4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0158.594] WriteFile (in: hFile=0x4e4, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0158.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6bfe020 | out: hHeap=0x310000) returned 1 [0160.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0160.134] CloseHandle (hObject=0x4e4) returned 1 [0160.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0160.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0160.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0160.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0160.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0160.136] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0160.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0160.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0160.137] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.137] GetLastError () returned 0x0 [0160.137] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0160.138] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0160.138] GetLastError () returned 0x0 [0160.138] SetLastError (dwErrCode=0x0) [0160.138] GetLastError () returned 0x0 [0160.139] SetLastError (dwErrCode=0x0) [0160.139] GetLastError () returned 0x0 [0160.139] SetLastError (dwErrCode=0x0) [0160.139] GetLastError () returned 0x0 [0160.139] SetLastError (dwErrCode=0x0) [0160.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0160.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DGRwSlln9d6SmpJIsBGN", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0160.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0160.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DGRwSlln9d6SmpJIsBGN", cchWideChar=20, lpMultiByteStr=0x38c390, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DGRwSlln9d6SmpJIsBGN", lpUsedDefaultChar=0x0) returned 20 [0160.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0160.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0160.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bab400 [0160.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0160.139] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0160.140] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x316fc18*=0xe67, lpOverlapped=0x0) returned 1 [0160.141] CloseHandle (hObject=0x4e4) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0160.142] CryptDestroyKey (hKey=0x5261008) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060de8 | out: hHeap=0x310000) returned 1 [0160.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5df0 | out: hHeap=0x310000) returned 1 [0160.142] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0160.142] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0160.142] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.142] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0160.432] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.432] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0160.433] CloseHandle (hObject=0x4e4) returned 1 [0160.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0160.433] RmStartSession () returned 0x0 [0160.521] RmRegisterResources () returned 0x0 [0160.525] RmGetList () returned 0x0 [0160.671] RmShutdown () returned 0x0 [0162.044] RmEndSession () returned 0x0 [0162.370] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260c88) returned 1 [0162.370] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0162.370] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0162.370] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0162.371] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0162.371] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=2192672) returned 1 [0162.371] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8568 [0162.371] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6ade020 [0162.390] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0162.390] ReadFile (in: hFile=0x4e4, lpBuffer=0x6ade040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6ade040*, lpNumberOfBytesRead=0x316fca4*=0x100000, lpOverlapped=0x0) returned 1 [0162.627] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0162.627] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.627] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.627] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.627] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.627] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.627] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.627] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.628] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.628] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.628] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.628] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.628] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.629] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.629] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.630] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.630] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.631] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.631] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.632] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.632] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.633] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.633] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.634] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.634] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.635] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.635] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.689] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.691] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.691] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.691] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.691] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.691] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.691] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.691] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.691] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.691] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.691] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.692] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.693] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.693] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.693] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.693] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.693] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.693] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.693] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.693] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.693] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.694] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.699] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.699] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.699] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.699] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.699] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.700] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.701] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.701] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.703] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.703] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.704] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.704] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.705] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.705] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.706] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.706] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0162.707] WriteFile (in: hFile=0x4e4, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0162.707] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0162.708] WriteFile (in: hFile=0x4e4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0162.710] WriteFile (in: hFile=0x4e4, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0162.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6ade020 | out: hHeap=0x310000) returned 1 [0163.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8568 | out: hHeap=0x310000) returned 1 [0163.001] CloseHandle (hObject=0x4e4) returned 1 [0163.214] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0163.214] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51f1de8 [0163.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4908 [0163.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51f2898 [0163.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51f1de8 | out: hHeap=0x310000) returned 1 [0163.231] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.bdcddcbaad"), dwFlags=0x1) returned 1 [0163.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0163.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b810 [0163.232] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.232] GetLastError () returned 0x0 [0163.232] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0163.233] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0163.233] GetLastError () returned 0x0 [0163.233] SetLastError (dwErrCode=0x0) [0163.233] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x528e490 [0163.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] GetLastError () returned 0x0 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0163.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0163.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x38c520, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", lpUsedDefaultChar=0x0) returned 30 [0163.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x528e490 | out: hHeap=0x310000) returned 1 [0163.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0163.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5ad2068 [0163.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0163.235] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0163.236] WriteFile (in: hFile=0x4e4, lpBuffer=0x5ad2068*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x5ad2068*, lpNumberOfBytesWritten=0x316fc18*=0xe71, lpOverlapped=0x0) returned 1 [0163.236] CloseHandle (hObject=0x4e4) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ad2068 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b810 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51f2898 | out: hHeap=0x310000) returned 1 [0163.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4908 | out: hHeap=0x310000) returned 1 [0163.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0163.239] CryptDestroyKey (hKey=0x5260c88) returned 1 [0163.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0163.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364f78 | out: hHeap=0x310000) returned 1 [0163.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365458 | out: hHeap=0x310000) returned 1 [0163.239] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0163.239] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0163.239] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.239] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0163.243] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.243] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0163.243] CloseHandle (hObject=0x4e4) returned 1 [0163.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dccd8 [0163.243] RmStartSession () returned 0x0 [0165.457] RmRegisterResources () returned 0x0 [0165.461] RmGetList () returned 0x0 [0168.294] RmShutdown () returned 0x0 [0169.771] RmEndSession () returned 0x0 [0169.772] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261608) returned 1 [0169.772] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0169.773] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x20) returned 1 [0169.773] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0169.773] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0169.773] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0169.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0169.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58cc020 [0170.644] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0170.644] ReadFile (in: hFile=0x660, lpBuffer=0x58cc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x58cc040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0170.647] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.647] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.648] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.648] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.648] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.648] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.648] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.648] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.648] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.648] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.649] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.649] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.649] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.649] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.649] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.649] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.649] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0170.649] WriteFile (in: hFile=0x660, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0170.649] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0170.649] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0170.650] WriteFile (in: hFile=0x660, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0170.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58cc020 | out: hHeap=0x310000) returned 1 [0172.388] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0172.388] CloseHandle (hObject=0x660) returned 1 [0172.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0172.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x53383b8 [0172.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5333608 [0172.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x53382e0 [0172.390] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53383b8 | out: hHeap=0x310000) returned 1 [0172.390] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0172.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5334018 [0172.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0172.391] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3c48 [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] GetLastError () returned 0x0 [0172.391] SetLastError (dwErrCode=0x0) [0172.391] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0172.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0172.392] GetLastError () returned 0x0 [0172.392] SetLastError (dwErrCode=0x0) [0172.392] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0172.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] GetLastError () returned 0x0 [0172.393] SetLastError (dwErrCode=0x0) [0172.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3c48 | out: hHeap=0x310000) returned 1 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0172.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x38c3b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UEjFQfiUE0cHCwyiRVml9x2esrd", lpUsedDefaultChar=0x0) returned 27 [0172.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0172.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0172.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397720 [0172.394] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0172.394] WriteFile (in: hFile=0x660, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x316fc18*=0xe6e, lpOverlapped=0x0) returned 1 [0172.395] CloseHandle (hObject=0x660) returned 1 [0172.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397720 | out: hHeap=0x310000) returned 1 [0172.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0172.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5334018 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53382e0 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5333608 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0172.396] CryptDestroyKey (hKey=0x5261608) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dccd8 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390df0 | out: hHeap=0x310000) returned 1 [0172.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0172.396] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0172.396] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0172.396] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.396] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0172.399] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.399] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0172.399] CloseHandle (hObject=0x660) returned 1 [0172.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4a18 [0172.399] RmStartSession () returned 0x0 [0172.401] RmRegisterResources () returned 0x0 [0172.404] RmGetList () returned 0x0 [0173.133] RmShutdown () returned 0x0 [0175.520] RmEndSession () returned 0x0 [0175.521] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52614c8) returned 1 [0175.521] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0175.521] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0175.521] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0175.521] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0175.521] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0175.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x51cbab0 [0175.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x68b2020 [0175.828] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0175.828] ReadFile (in: hFile=0x660, lpBuffer=0x68b2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x68b2040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0175.830] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0175.830] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.830] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.830] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.830] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x51cbac0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0175.831] WriteFile (in: hFile=0x660, lpBuffer=0x51cbac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x51cbac0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0175.832] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0175.832] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0175.832] WriteFile (in: hFile=0x660, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0175.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x68b2020 | out: hHeap=0x310000) returned 1 [0175.848] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cbab0 | out: hHeap=0x310000) returned 1 [0175.848] CloseHandle (hObject=0x660) returned 1 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321ce0 [0175.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0175.851] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0175.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0175.852] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a44c8 [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] GetLastError () returned 0x0 [0175.852] SetLastError (dwErrCode=0x0) [0175.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0175.852] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a44c8 | out: hHeap=0x310000) returned 1 [0175.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0175.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x316fae0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0175.852] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0175.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0175.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0175.853] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0175.853] WriteFile (in: hFile=0x660, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x316fc18*=0xe5b, lpOverlapped=0x0) returned 1 [0175.854] CloseHandle (hObject=0x660) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321ce0 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0175.855] CryptDestroyKey (hKey=0x52614c8) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4a18 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ead80 | out: hHeap=0x310000) returned 1 [0175.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6330 | out: hHeap=0x310000) returned 1 [0175.855] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0175.855] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0175.856] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.856] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0175.974] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.974] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0175.974] CloseHandle (hObject=0x660) returned 1 [0175.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0175.974] RmStartSession () returned 0x0 [0176.059] RmRegisterResources () returned 0x0 [0176.063] RmGetList () returned 0x0 [0176.545] RmShutdown () returned 0x0 [0178.148] RmEndSession () returned 0x0 [0178.149] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261788) returned 1 [0178.149] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0178.149] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0178.149] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0178.150] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0178.150] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0178.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0178.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6660020 [0178.267] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0178.267] ReadFile (in: hFile=0x640, lpBuffer=0x6660040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6660040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0178.269] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0178.269] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.269] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.269] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.269] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.269] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.270] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0178.270] WriteFile (in: hFile=0x640, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0178.271] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0178.271] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0178.271] WriteFile (in: hFile=0x640, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0178.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6660020 | out: hHeap=0x310000) returned 1 [0178.300] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0178.300] CloseHandle (hObject=0x640) returned 1 [0178.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0178.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53232d8 [0178.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0178.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322eb0 [0178.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53232d8 | out: hHeap=0x310000) returned 1 [0178.302] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0178.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0178.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0178.303] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0178.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x316fae0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cTrvvrwpmgtguVI", lpUsedDefaultChar=0x0) returned 15 [0178.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0178.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0178.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0178.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0178.305] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0178.397] WriteFile (in: hFile=0x640, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x316fc18*=0xe62, lpOverlapped=0x0) returned 1 [0178.398] CloseHandle (hObject=0x640) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322eb0 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0178.399] CryptDestroyKey (hKey=0x5261788) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eacf8 | out: hHeap=0x310000) returned 1 [0178.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e61f0 | out: hHeap=0x310000) returned 1 [0178.399] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0178.399] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0178.399] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.399] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0178.445] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.445] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0178.445] CloseHandle (hObject=0x640) returned 1 [0178.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0178.445] RmStartSession () returned 0x0 [0178.449] RmRegisterResources () returned 0x0 [0178.453] RmGetList () returned 0x0 [0179.715] RmShutdown () returned 0x0 [0180.889] RmEndSession () returned 0x0 [0181.767] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261008) returned 1 [0181.767] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0181.768] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0181.768] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0181.768] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0181.768] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0181.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2088 [0181.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5727020 [0181.787] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0181.787] ReadFile (in: hFile=0x640, lpBuffer=0x5727040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x5727040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0181.825] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.826] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.826] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.827] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.827] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.827] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.827] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0181.827] WriteFile (in: hFile=0x640, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0181.827] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0181.827] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0181.827] WriteFile (in: hFile=0x640, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0181.827] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5727020 | out: hHeap=0x310000) returned 1 [0181.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2088 | out: hHeap=0x310000) returned 1 [0181.832] CloseHandle (hObject=0x640) returned 1 [0181.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0181.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0181.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0181.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0181.835] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0181.835] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0181.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0181.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0181.836] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] GetLastError () returned 0x0 [0181.836] SetLastError (dwErrCode=0x0) [0181.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0181.836] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] SetLastError (dwErrCode=0x0) [0181.837] GetLastError () returned 0x0 [0181.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0181.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0181.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x38c3e0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YymLG954e9jSNEr4fGTQUdOu0cPg", lpUsedDefaultChar=0x0) returned 28 [0181.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab0e8 | out: hHeap=0x310000) returned 1 [0182.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0182.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5410238 [0182.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0182.341] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0182.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0182.342] CryptDestroyKey (hKey=0x5261008) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea258 | out: hHeap=0x310000) returned 1 [0182.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6920 | out: hHeap=0x310000) returned 1 [0182.342] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0182.342] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0182.342] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.342] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0182.343] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.344] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0182.344] CloseHandle (hObject=0x610) returned 1 [0182.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0b58 [0182.344] RmStartSession () returned 0x0 [0182.921] RmRegisterResources () returned 0x0 [0182.925] RmGetList () returned 0x0 [0185.428] RmShutdown () returned 0x0 [0186.096] RmEndSession () returned 0x0 [0186.369] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260cc8) returned 1 [0186.369] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0186.369] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0186.369] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0186.369] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0186.369] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5415ce0 [0186.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a57020 [0186.393] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0186.393] ReadFile (in: hFile=0x610, lpBuffer=0x6a57040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6a57040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0186.541] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.541] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.541] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.541] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.541] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.541] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.541] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.542] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.542] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.542] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0186.542] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0186.542] WriteFile (in: hFile=0x610, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0186.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a57020 | out: hHeap=0x310000) returned 1 [0186.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5415ce0 | out: hHeap=0x310000) returned 1 [0186.550] CloseHandle (hObject=0x610) returned 1 [0186.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0186.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0186.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0186.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0186.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0186.735] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0186.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0186.736] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0186.736] GetLastError () returned 0x0 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x316fae0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K5peP9WcLDHI", lpUsedDefaultChar=0x0) returned 12 [0186.736] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0186.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0186.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0186.736] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0186.737] WriteFile (in: hFile=0x484, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x316fc18*=0xe5f, lpOverlapped=0x0) returned 1 [0186.738] CloseHandle (hObject=0x484) returned 1 [0186.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0186.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0186.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0186.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0186.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0186.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0186.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0186.739] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0186.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0186.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0186.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6d80 | out: hHeap=0x310000) returned 1 [0186.739] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0186.739] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0186.739] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.739] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0186.802] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.803] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0186.803] CloseHandle (hObject=0x484) returned 1 [0186.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9e00 [0186.803] RmStartSession () returned 0x0 [0186.990] RmRegisterResources () returned 0x0 [0186.995] RmGetList () returned 0x0 [0187.190] RmShutdown () returned 0x0 [0188.430] RmEndSession () returned 0x0 [0188.431] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261188) returned 1 [0188.431] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0188.431] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0188.432] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0188.432] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0188.432] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0188.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0188.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64ba020 [0189.036] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0189.036] ReadFile (in: hFile=0x484, lpBuffer=0x64ba040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x64ba040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0189.038] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.039] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.039] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.040] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.040] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.040] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.040] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0189.040] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0189.040] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0189.041] WriteFile (in: hFile=0x484, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0189.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64ba020 | out: hHeap=0x310000) returned 1 [0190.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0190.302] CloseHandle (hObject=0x484) returned 1 [0190.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0190.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61369a0 [0190.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51ca1f0 [0190.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61373b0 [0190.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61369a0 | out: hHeap=0x310000) returned 1 [0190.305] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c96c8 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0190.306] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0190.306] GetLastError () returned 0x0 [0190.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x38c3b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tRdDQltWN4PVKdRqXUoqyy", lpUsedDefaultChar=0x0) returned 22 [0190.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540c818 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540ab08 [0190.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0190.306] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0190.307] WriteFile (in: hFile=0x484, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x316fc18*=0xe69, lpOverlapped=0x0) returned 1 [0190.310] CloseHandle (hObject=0x484) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540c818 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c96c8 | out: hHeap=0x310000) returned 1 [0190.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61373b0 | out: hHeap=0x310000) returned 1 [0190.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ca1f0 | out: hHeap=0x310000) returned 1 [0190.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0190.311] CryptDestroyKey (hKey=0x5261188) returned 1 [0190.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9e00 | out: hHeap=0x310000) returned 1 [0190.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c924d8 | out: hHeap=0x310000) returned 1 [0190.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3659a8 | out: hHeap=0x310000) returned 1 [0190.311] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0190.311] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0190.311] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.311] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.339] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0190.339] CloseHandle (hObject=0x484) returned 1 [0190.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51cdf08 [0190.339] RmStartSession () returned 0x0 [0190.342] RmRegisterResources () returned 0x0 [0190.345] RmGetList () returned 0x0 [0191.738] RmShutdown () returned 0x0 [0193.921] RmEndSession () returned 0x0 [0194.055] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260cc8) returned 1 [0194.055] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0194.056] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x20) returned 1 [0194.056] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0194.056] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0194.056] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=69632) returned 1 [0194.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0194.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2c020 [0194.824] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0194.824] ReadFile (in: hFile=0x484, lpBuffer=0x4c2c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x4c2c040*, lpNumberOfBytesRead=0x316fca4*=0x11000, lpOverlapped=0x0) returned 1 [0194.826] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0194.826] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.826] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.826] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.826] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.826] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.826] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.826] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.826] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.826] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.826] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.827] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.827] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.827] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.827] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0194.827] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0194.827] WriteFile (in: hFile=0x484, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0194.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c2c020 | out: hHeap=0x310000) returned 1 [0194.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0194.833] CloseHandle (hObject=0x484) returned 1 [0194.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0194.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x5418048 [0194.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5424e60 [0194.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x5418120 [0194.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5418048 | out: hHeap=0x310000) returned 1 [0194.833] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0194.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5423f88 [0194.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0194.834] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0194.834] GetLastError () returned 0x0 [0194.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B4f0ZF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0194.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B4f0ZF", cchWideChar=6, lpMultiByteStr=0x316fae0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B4f0ZF", lpUsedDefaultChar=0x0) returned 6 [0194.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0194.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0194.834] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0194.835] WriteFile (in: hFile=0x484, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x316fc18*=0xe59, lpOverlapped=0x0) returned 1 [0194.836] CloseHandle (hObject=0x484) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5423f88 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5418120 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5424e60 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0194.836] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cdf08 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a1618 | out: hHeap=0x310000) returned 1 [0194.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44b78 | out: hHeap=0x310000) returned 1 [0194.836] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0194.837] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0194.837] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.837] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0194.839] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.839] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0194.839] CloseHandle (hObject=0x484) returned 1 [0194.839] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea610 [0194.839] RmStartSession () returned 0x0 [0194.840] RmRegisterResources () returned 0x0 [0194.846] RmGetList () returned 0x0 [0195.221] RmShutdown () returned 0x0 [0195.917] RmEndSession () returned 0x0 [0195.918] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260c48) returned 1 [0195.918] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0195.918] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", dwFileAttributes=0x20) returned 0 [0195.918] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.918] CryptDestroyKey (hKey=0x5260c48) returned 1 [0195.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea610 | out: hHeap=0x310000) returned 1 [0195.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0195.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44998 | out: hHeap=0x310000) returned 1 [0195.918] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0195.918] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0195.919] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.919] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0195.960] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.960] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0195.960] CloseHandle (hObject=0x484) returned 1 [0195.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356c60 [0195.960] RmStartSession () returned 0x0 [0195.961] RmRegisterResources () returned 0x0 [0195.966] RmGetList () returned 0x0 [0196.170] RmShutdown () returned 0x0 [0199.115] RmEndSession () returned 0x0 [0199.312] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260f88) returned 1 [0199.312] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0199.312] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0199.312] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0199.312] CryptDestroyKey (hKey=0x5260f88) returned 1 [0199.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356c60 | out: hHeap=0x310000) returned 1 [0199.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93000 | out: hHeap=0x310000) returned 1 [0199.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07ab0 | out: hHeap=0x310000) returned 1 [0199.313] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0199.313] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0199.313] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.313] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0199.352] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.353] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0199.353] CloseHandle (hObject=0x4d4) returned 1 [0199.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b68b0 [0199.353] RmStartSession () returned 0x0 [0199.462] RmRegisterResources () returned 0x0 [0199.467] RmGetList () returned 0x0 [0201.009] RmShutdown () returned 0x0 [0201.741] RmEndSession () returned 0x0 [0201.742] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x35dc88) returned 1 [0201.742] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0201.742] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui", dwFileAttributes=0x20) returned 0 [0201.742] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.742] CryptDestroyKey (hKey=0x35dc88) returned 1 [0201.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b68b0 | out: hHeap=0x310000) returned 1 [0201.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92ac0 | out: hHeap=0x310000) returned 1 [0201.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07ce0 | out: hHeap=0x310000) returned 1 [0201.742] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0201.742] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0201.742] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.742] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0201.746] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.746] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0201.746] CloseHandle (hObject=0x4d4) returned 1 [0201.746] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b68b0 [0201.746] RmStartSession () returned 0x0 [0201.750] RmRegisterResources () returned 0x0 [0201.754] RmGetList () returned 0x0 [0202.798] RmShutdown () returned 0x0 [0204.179] RmEndSession () returned 0x0 [0204.455] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260e48) returned 1 [0204.455] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0204.455] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0204.456] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.456] CryptDestroyKey (hKey=0x5260e48) returned 1 [0204.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b68b0 | out: hHeap=0x310000) returned 1 [0204.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92190 | out: hHeap=0x310000) returned 1 [0204.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08050 | out: hHeap=0x310000) returned 1 [0204.456] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0204.456] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0204.642] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.643] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0204.645] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.645] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0204.646] CloseHandle (hObject=0x52c) returned 1 [0204.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8dd0 [0204.646] RmStartSession () returned 0x0 [0204.750] RmRegisterResources () returned 0x0 [0204.754] RmGetList () returned 0x0 [0205.792] RmShutdown () returned 0x0 [0206.701] RmEndSession () returned 0x0 [0206.702] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261988) returned 1 [0206.702] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0206.702] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", dwFileAttributes=0x20) returned 0 [0206.702] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.703] CryptDestroyKey (hKey=0x5261988) returned 1 [0206.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8dd0 | out: hHeap=0x310000) returned 1 [0206.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cdc8 | out: hHeap=0x310000) returned 1 [0206.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c086e0 | out: hHeap=0x310000) returned 1 [0206.703] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0206.703] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0206.733] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.733] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0206.734] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.734] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0206.734] CloseHandle (hObject=0x55c) returned 1 [0206.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f9168 [0206.735] RmStartSession () returned 0x0 [0206.737] RmRegisterResources () returned 0x0 [0206.921] RmGetList () returned 0x0 [0208.051] RmShutdown () returned 0x0 [0213.499] RmEndSession () returned 0x0 [0213.759] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5260e08) returned 1 [0213.759] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0213.759] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", dwFileAttributes=0x20) returned 0 [0213.759] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.759] CryptDestroyKey (hKey=0x5260e08) returned 1 [0213.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9168 | out: hHeap=0x310000) returned 1 [0213.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a12f8 | out: hHeap=0x310000) returned 1 [0213.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08960 | out: hHeap=0x310000) returned 1 [0213.759] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0213.759] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0213.830] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.830] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0213.870] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.870] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0213.870] CloseHandle (hObject=0x56c) returned 1 [0213.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd428 [0213.870] RmStartSession () returned 0x0 [0213.873] RmRegisterResources () returned 0x0 [0213.873] RmGetList () returned 0x0 [0213.991] RmShutdown () returned 0x0 [0216.418] RmEndSession () returned 0x0 [0216.510] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261948) returned 1 [0216.510] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0216.510] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml", dwFileAttributes=0x20) returned 0 [0216.510] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.510] CryptDestroyKey (hKey=0x5261948) returned 1 [0216.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd428 | out: hHeap=0x310000) returned 1 [0216.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea0c0 | out: hHeap=0x310000) returned 1 [0216.510] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a56a0 | out: hHeap=0x310000) returned 1 [0216.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0216.510] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0216.511] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.511] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0216.553] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.553] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0216.553] CloseHandle (hObject=0x56c) returned 1 [0216.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc6e0 [0216.554] RmStartSession () returned 0x0 [0216.556] RmRegisterResources () returned 0x0 [0216.557] RmGetList () returned 0x0 [0217.177] RmShutdown () returned 0x0 [0220.428] RmEndSession () returned 0x0 [0220.429] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261a48) returned 1 [0220.429] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0220.429] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml", dwFileAttributes=0x20) returned 0 [0220.429] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.429] CryptDestroyKey (hKey=0x5261a48) returned 1 [0220.430] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc6e0 | out: hHeap=0x310000) returned 1 [0220.430] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebc60 | out: hHeap=0x310000) returned 1 [0220.430] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a61e0 | out: hHeap=0x310000) returned 1 [0220.430] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0220.430] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0220.430] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.430] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0220.479] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.479] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0220.479] CloseHandle (hObject=0x56c) returned 1 [0220.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0220.480] RmStartSession () returned 0x0 [0220.483] RmRegisterResources () returned 0x0 [0220.489] RmGetList () returned 0x0 [0221.749] RmShutdown () returned 0x0 [0225.113] RmEndSession () returned 0x0 [0225.620] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261888) returned 1 [0225.620] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0225.621] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.621] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.621] CryptDestroyKey (hKey=0x5261888) returned 1 [0225.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0225.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eeb28 | out: hHeap=0x310000) returned 1 [0225.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14ab0 | out: hHeap=0x310000) returned 1 [0225.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0225.621] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0225.627] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.627] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0225.629] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.629] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0225.629] CloseHandle (hObject=0x56c) returned 1 [0225.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0225.629] RmStartSession () returned 0x0 [0225.664] RmRegisterResources () returned 0x0 [0225.664] RmGetList () returned 0x0 [0225.696] RmShutdown () returned 0x0 [0226.104] RmEndSession () returned 0x0 [0226.105] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52616c8) returned 1 [0226.105] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0226.105] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x20) returned 0 [0226.105] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.105] CryptDestroyKey (hKey=0x52616c8) returned 1 [0226.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0226.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eefc0 | out: hHeap=0x310000) returned 1 [0226.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14bf0 | out: hHeap=0x310000) returned 1 [0226.106] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0226.106] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0226.122] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.122] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0226.279] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.280] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0226.280] CloseHandle (hObject=0x618) returned 1 [0226.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0226.280] RmStartSession () returned 0x0 [0226.281] RmRegisterResources () returned 0x0 [0226.282] RmGetList () returned 0x0 [0226.942] RmShutdown () returned 0x0 [0227.587] RmEndSession () returned 0x0 [0228.445] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261748) returned 1 [0228.445] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0228.445] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", dwFileAttributes=0x20) returned 0 [0228.446] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.446] CryptDestroyKey (hKey=0x5261748) returned 1 [0228.446] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0228.446] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee0a8 | out: hHeap=0x310000) returned 1 [0228.446] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14d80 | out: hHeap=0x310000) returned 1 [0228.446] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0228.446] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0228.450] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.450] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0228.451] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.451] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0228.451] CloseHandle (hObject=0x640) returned 1 [0228.451] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0228.451] RmStartSession () returned 0x0 [0228.521] RmRegisterResources () returned 0x0 [0228.521] RmGetList () returned 0x0 [0228.732] RmShutdown () returned 0x0 [0229.748] RmEndSession () returned 0x0 [0229.818] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261648) returned 1 [0229.818] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0229.818] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", dwFileAttributes=0x20) returned 0 [0229.818] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.818] CryptDestroyKey (hKey=0x5261648) returned 1 [0229.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0229.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef1b8 | out: hHeap=0x310000) returned 1 [0229.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14f10 | out: hHeap=0x310000) returned 1 [0229.818] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0229.818] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0229.818] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.818] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0229.842] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.842] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0229.843] CloseHandle (hObject=0x618) returned 1 [0229.843] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0229.843] RmStartSession () returned 0x0 [0230.092] RmRegisterResources () returned 0x0 [0230.092] RmGetList () returned 0x0 [0230.293] RmShutdown () returned 0x0 [0231.468] RmEndSession () returned 0x0 [0231.859] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261188) returned 1 [0231.859] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0231.859] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado25.tlb", dwFileAttributes=0x20) returned 0 [0231.859] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.860] CryptDestroyKey (hKey=0x5261188) returned 1 [0231.860] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0231.860] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19b28 | out: hHeap=0x310000) returned 1 [0231.860] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e30 | out: hHeap=0x310000) returned 1 [0231.860] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0231.860] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0231.860] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.860] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0231.913] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.913] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0231.914] CloseHandle (hObject=0x5a8) returned 1 [0231.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0231.914] RmStartSession () returned 0x0 [0231.916] RmRegisterResources () returned 0x0 [0231.921] RmGetList () returned 0x0 [0234.399] RmShutdown () returned 0x0 [0237.667] RmEndSession () returned 0x0 [0237.847] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261888) returned 1 [0237.847] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0237.848] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", dwFileAttributes=0x20) returned 0 [0237.848] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.848] CryptDestroyKey (hKey=0x5261888) returned 1 [0237.848] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0237.848] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb2d0 | out: hHeap=0x310000) returned 1 [0237.848] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55728d8 | out: hHeap=0x310000) returned 1 [0237.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0237.848] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0237.848] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.848] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0237.879] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.879] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0237.879] CloseHandle (hObject=0x69c) returned 1 [0237.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0237.879] RmStartSession () returned 0x0 [0237.881] RmRegisterResources () returned 0x0 [0237.895] RmGetList () returned 0x0 [0238.799] RmShutdown () returned 0x0 [0240.747] RmEndSession () returned 0x0 [0240.748] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261648) returned 1 [0240.748] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0240.748] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties", dwFileAttributes=0x20) returned 1 [0240.748] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0240.748] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0240.748] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=5548) returned 1 [0240.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b63030 [0240.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58e9020 [0241.104] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0241.104] ReadFile (in: hFile=0x69c, lpBuffer=0x58e9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x58e9040*, lpNumberOfBytesRead=0x316fca4*=0x15ac, lpOverlapped=0x0) returned 1 [0241.106] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0241.106] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b63040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b63040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0241.106] WriteFile (in: hFile=0x69c, lpBuffer=0x4b63040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4b63040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0241.106] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0241.106] WriteFile (in: hFile=0x69c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0241.106] WriteFile (in: hFile=0x69c, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0241.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58e9020 | out: hHeap=0x310000) returned 1 [0241.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b63030 | out: hHeap=0x310000) returned 1 [0241.538] CloseHandle (hObject=0x69c) returned 1 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0241.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0241.539] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0241.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0241.539] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0241.539] GetLastError () returned 0x0 [0241.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0241.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0241.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x38c3b8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", lpUsedDefaultChar=0x0) returned 28 [0241.540] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e5980 | out: hHeap=0x310000) returned 1 [0241.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0241.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0241.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0241.540] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0241.540] WriteFile (in: hFile=0x69c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe6f, lpOverlapped=0x0) returned 1 [0241.541] CloseHandle (hObject=0x69c) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0241.541] CryptDestroyKey (hKey=0x5261648) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571218 | out: hHeap=0x310000) returned 1 [0241.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572338 | out: hHeap=0x310000) returned 1 [0241.541] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0241.541] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0241.547] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.548] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0241.555] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.555] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0241.555] CloseHandle (hObject=0x69c) returned 1 [0241.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a488 [0241.555] RmStartSession () returned 0x0 [0241.557] RmRegisterResources () returned 0x0 [0241.561] RmGetList () returned 0x0 [0243.152] RmShutdown () returned 0x0 [0246.445] RmEndSession () returned 0x0 [0246.446] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261a88) returned 1 [0246.446] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0246.446] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", dwFileAttributes=0x20) returned 1 [0246.446] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0246.446] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0246.446] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=5040094) returned 1 [0246.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54b7e48 [0246.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0247.984] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0247.984] GetLastError () returned 0x0 [0247.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0247.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0247.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35nXCJ3t7DcPBvTOWYb", lpUsedDefaultChar=0x0) returned 19 [0247.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0247.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0247.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0247.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0247.984] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0247.985] WriteFile (in: hFile=0x69c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x316fc18*=0xe66, lpOverlapped=0x0) returned 1 [0247.986] CloseHandle (hObject=0x69c) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19858 | out: hHeap=0x310000) returned 1 [0247.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0247.986] CryptDestroyKey (hKey=0x5261a88) returned 1 [0247.987] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0247.987] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39760 | out: hHeap=0x310000) returned 1 [0247.987] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352830 | out: hHeap=0x310000) returned 1 [0247.987] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0247.987] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0247.987] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.987] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0248.485] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.485] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0248.485] CloseHandle (hObject=0x69c) returned 1 [0248.485] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0248.486] RmStartSession () returned 0x0 [0248.673] RmRegisterResources () returned 0x0 [0248.673] RmGetList () returned 0x0 [0248.791] RmShutdown () returned 0x0 [0249.075] RmEndSession () returned 0x0 [0249.313] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52616c8) returned 1 [0249.313] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0249.313] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0249.313] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0249.313] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0249.313] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=147) returned 1 [0249.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0249.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e3020 [0249.394] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0249.394] GetLastError () returned 0x0 [0249.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0249.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c160, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0249.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0249.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0249.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0249.395] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0249.395] WriteFile (in: hFile=0x69c, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x316fc18*=0xe69, lpOverlapped=0x0) returned 1 [0249.396] CloseHandle (hObject=0x69c) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0249.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9de8 | out: hHeap=0x310000) returned 1 [0249.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0249.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0249.397] CryptDestroyKey (hKey=0x52616c8) returned 1 [0249.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0249.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef5a8 | out: hHeap=0x310000) returned 1 [0249.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352f60 | out: hHeap=0x310000) returned 1 [0249.397] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0249.397] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0249.397] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.397] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0249.440] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.440] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0249.440] CloseHandle (hObject=0x69c) returned 1 [0249.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d08 [0249.440] RmStartSession () returned 0x0 [0249.853] RmRegisterResources () returned 0x0 [0249.853] RmGetList () returned 0x0 [0249.951] RmShutdown () returned 0x0 [0250.671] RmEndSession () returned 0x0 [0250.672] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261048) returned 1 [0250.672] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0250.672] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc", dwFileAttributes=0x20) returned 1 [0250.672] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0250.672] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0250.672] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=20065) returned 1 [0250.672] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54b7e48 [0250.672] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6212020 [0251.128] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0251.128] ReadFile (in: hFile=0x670, lpBuffer=0x6212040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x6212040*, lpNumberOfBytesRead=0x316fca4*=0x4e61, lpOverlapped=0x0) returned 1 [0251.130] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0251.130] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0251.130] WriteFile (in: hFile=0x670, lpBuffer=0x54b7e60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x54b7e60*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0251.130] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0251.130] WriteFile (in: hFile=0x670, lpBuffer=0x54b7e60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x54b7e60*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0251.130] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x54b7e60*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0251.131] WriteFile (in: hFile=0x670, lpBuffer=0x54b7e60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x54b7e60*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0251.131] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0251.131] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0251.131] WriteFile (in: hFile=0x670, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0251.131] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6212020 | out: hHeap=0x310000) returned 1 [0251.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54b7e48 | out: hHeap=0x310000) returned 1 [0251.429] CloseHandle (hObject=0x670) returned 1 [0251.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0251.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0251.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0251.429] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0251.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0251.429] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19fd8 [0251.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0251.456] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0251.456] GetLastError () returned 0x0 [0251.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0251.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c480, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f29c0 | out: hHeap=0x310000) returned 1 [0251.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0251.456] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54ee468 [0251.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0251.457] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0251.457] WriteFile (in: hFile=0x670, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x316fc18*=0xe70, lpOverlapped=0x0) returned 1 [0251.458] CloseHandle (hObject=0x670) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19fd8 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0251.458] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0251.459] CryptDestroyKey (hKey=0x5261048) returned 1 [0251.459] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d08 | out: hHeap=0x310000) returned 1 [0251.459] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39fd0 | out: hHeap=0x310000) returned 1 [0251.459] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352ec0 | out: hHeap=0x310000) returned 1 [0251.459] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0251.459] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0251.459] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.459] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0251.462] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.462] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0251.462] CloseHandle (hObject=0x670) returned 1 [0251.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a410 [0251.462] RmStartSession () returned 0x0 [0251.464] RmRegisterResources () returned 0x0 [0251.464] RmGetList () returned 0x0 [0253.448] RmShutdown () returned 0x0 [0254.176] RmEndSession () returned 0x0 [0254.177] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261088) returned 1 [0254.177] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0254.177] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", dwFileAttributes=0x20) returned 1 [0254.177] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0254.177] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0254.177] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=1923211) returned 1 [0254.177] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b6b020 [0254.177] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b6020 [0254.541] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0254.541] ReadFile (in: hFile=0x670, lpBuffer=0x64b6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x64b6040*, lpNumberOfBytesRead=0x316fca4*=0x100000, lpOverlapped=0x0) returned 1 [0254.637] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.637] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.637] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.638] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.638] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.639] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.639] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.640] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.640] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.641] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.641] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.642] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.642] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.643] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.643] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.644] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.644] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.645] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.645] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.646] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.646] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.647] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.648] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.648] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.649] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.649] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.650] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.650] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.651] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.651] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.652] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.652] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.653] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.653] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0254.654] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0254.654] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0254.655] ReadFile (in: hFile=0x670, lpBuffer=0x64b6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x64b6040*, lpNumberOfBytesRead=0x316fca4*=0xd588b, lpOverlapped=0x0) returned 1 [0255.674] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0255.674] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.674] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.674] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.674] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.675] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.675] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.676] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.676] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.677] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.677] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.678] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.678] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.679] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.680] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.681] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.681] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.682] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.682] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.683] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.683] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.684] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.684] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.685] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.685] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.686] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.686] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.687] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.687] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.688] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.688] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.689] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.689] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.689] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b040*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0255.689] WriteFile (in: hFile=0x670, lpBuffer=0x6b6b040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6b6b040*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0255.689] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0255.689] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0255.689] WriteFile (in: hFile=0x670, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0255.689] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b6020 | out: hHeap=0x310000) returned 1 [0256.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b6b020 | out: hHeap=0x310000) returned 1 [0256.056] CloseHandle (hObject=0x670) returned 1 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0256.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0256.057] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0256.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0256.058] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0256.058] GetLastError () returned 0x0 [0256.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x316fae0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uZdPMPqLr8IS7", lpUsedDefaultChar=0x0) returned 13 [0256.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0256.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0256.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0256.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0256.058] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0256.059] WriteFile (in: hFile=0x670, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe60, lpOverlapped=0x0) returned 1 [0256.060] CloseHandle (hObject=0x670) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0256.060] CryptDestroyKey (hKey=0x5261088) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39940 | out: hHeap=0x310000) returned 1 [0256.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352dd0 | out: hHeap=0x310000) returned 1 [0256.060] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0256.060] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0256.061] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.061] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0256.062] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.062] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0256.062] CloseHandle (hObject=0x670) returned 1 [0256.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0256.062] RmStartSession () returned 0x0 [0256.337] RmRegisterResources () returned 0x0 [0256.338] RmGetList () returned 0x0 [0256.375] RmShutdown () returned 0x0 [0257.300] RmEndSession () returned 0x0 [0257.301] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52619c8) returned 1 [0257.301] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0257.301] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", dwFileAttributes=0x20) returned 1 [0257.301] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0257.301] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0257.301] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=145180) returned 1 [0257.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0257.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58ed020 [0257.329] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0257.329] GetLastError () returned 0x0 [0257.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0257.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0257.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c3b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0257.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0257.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0257.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0257.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0257.329] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0257.330] WriteFile (in: hFile=0x550, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x316fc18*=0xe64, lpOverlapped=0x0) returned 1 [0257.331] CloseHandle (hObject=0x550) returned 1 [0257.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0257.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399140 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0257.332] CryptDestroyKey (hKey=0x52619c8) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3a28 | out: hHeap=0x310000) returned 1 [0257.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53517a0 | out: hHeap=0x310000) returned 1 [0257.332] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0257.332] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0257.332] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.332] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0258.035] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.035] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0258.035] CloseHandle (hObject=0x550) returned 1 [0258.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0258.065] RmStartSession () returned 0x0 [0258.068] RmRegisterResources () returned 0x0 [0258.069] RmGetList () returned 0x0 [0258.318] RmShutdown () returned 0x0 [0260.108] RmEndSession () returned 0x0 [0260.109] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261608) returned 1 [0260.109] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0260.109] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS", dwFileAttributes=0x20) returned 1 [0260.109] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0260.109] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0260.109] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=94467) returned 1 [0260.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0260.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x562b020 [0260.598] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0260.599] GetLastError () returned 0x0 [0260.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0260.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0260.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x38c390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", lpUsedDefaultChar=0x0) returned 26 [0260.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6115c60 | out: hHeap=0x310000) returned 1 [0260.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0260.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0260.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0260.647] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\office16\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0260.648] WriteFile (in: hFile=0x680, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe6d, lpOverlapped=0x0) returned 1 [0260.648] CloseHandle (hObject=0x680) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d18 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0260.649] CryptDestroyKey (hKey=0x5261608) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a2a8 | out: hHeap=0x310000) returned 1 [0260.649] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53517f0 | out: hHeap=0x310000) returned 1 [0260.649] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0260.649] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0260.649] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.649] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0260.651] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.651] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0260.651] CloseHandle (hObject=0x680) returned 1 [0260.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0be48 [0260.651] RmStartSession () returned 0x0 [0260.978] RmRegisterResources () returned 0x0 [0260.982] RmGetList () returned 0x0 [0261.875] RmShutdown () returned 0x0 [0263.187] RmEndSession () returned 0x0 [0263.188] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52612c8) returned 1 [0263.188] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0263.188] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0263.188] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0263.189] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0263.189] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=1261) returned 1 [0263.189] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0263.189] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf5020 [0263.299] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0263.299] GetLastError () returned 0x0 [0263.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0263.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x316fae0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0263.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0263.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0263.300] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0263.301] WriteFile (in: hFile=0x54c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x316fc18*=0xe57, lpOverlapped=0x0) returned 1 [0263.302] CloseHandle (hObject=0x54c) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f044d8 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a07a0 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f056f8 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0263.302] CryptDestroyKey (hKey=0x52612c8) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0be48 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa028 | out: hHeap=0x310000) returned 1 [0263.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351ed0 | out: hHeap=0x310000) returned 1 [0263.303] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0263.303] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0263.303] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0263.303] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0264.087] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0264.087] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0264.087] CloseHandle (hObject=0x54c) returned 1 [0264.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f05358 [0264.088] RmStartSession () returned 0x0 [0264.089] RmRegisterResources () returned 0x0 [0264.089] RmGetList () returned 0x0 [0264.114] RmShutdown () returned 0x0 [0266.419] RmEndSession () returned 0x0 [0266.420] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52617c8) returned 1 [0266.420] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0266.420] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0266.421] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0266.421] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0266.421] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=1261) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0266.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5844020 [0267.481] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0267.481] GetLastError () returned 0x0 [0267.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0267.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0267.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x38c160, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pvosW60j6t7if2aYH", lpUsedDefaultChar=0x0) returned 17 [0267.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0267.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0267.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0267.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0267.481] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0267.482] WriteFile (in: hFile=0x54c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x316fc18*=0xe64, lpOverlapped=0x0) returned 1 [0267.483] CloseHandle (hObject=0x54c) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5399268 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0267.483] CryptDestroyKey (hKey=0x52617c8) returned 1 [0267.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05358 | out: hHeap=0x310000) returned 1 [0267.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5347b28 | out: hHeap=0x310000) returned 1 [0267.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c196a0 | out: hHeap=0x310000) returned 1 [0267.484] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0267.484] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0267.484] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.484] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0267.512] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.512] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0267.512] CloseHandle (hObject=0x54c) returned 1 [0267.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0267.513] RmStartSession () returned 0x0 [0267.515] RmRegisterResources () returned 0x0 [0267.519] RmGetList () returned 0x0 [0268.586] RmShutdown () returned 0x0 [0270.706] RmEndSession () returned 0x0 [0270.732] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261a88) returned 1 [0270.733] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0270.733] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF", dwFileAttributes=0x220) returned 1 [0270.733] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0270.733] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0270.733] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=7686) returned 1 [0270.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0270.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5628020 [0275.771] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0275.771] GetLastError () returned 0x0 [0275.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WWGb0ObVfQVKUNp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0275.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WWGb0ObVfQVKUNp", cchWideChar=15, lpMultiByteStr=0x316fae0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WWGb0ObVfQVKUNp", lpUsedDefaultChar=0x0) returned 15 [0275.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0275.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0275.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0275.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.772] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0275.773] WriteFile (in: hFile=0x54c, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x316fc18*=0xe62, lpOverlapped=0x0) returned 1 [0275.773] CloseHandle (hObject=0x54c) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0e48 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0275.774] CryptDestroyKey (hKey=0x5261a88) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570b90 | out: hHeap=0x310000) returned 1 [0275.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3652c8 | out: hHeap=0x310000) returned 1 [0275.774] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0275.774] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0275.774] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.774] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0275.776] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.776] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0275.776] CloseHandle (hObject=0x54c) returned 1 [0275.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0275.776] RmStartSession () returned 0x0 [0275.779] RmRegisterResources () returned 0x0 [0275.779] RmGetList () returned 0x0 [0275.803] RmShutdown () returned 0x0 [0276.804] RmEndSession () returned 0x0 [0276.805] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52615c8) returned 1 [0276.805] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0276.805] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF", dwFileAttributes=0x220) returned 1 [0276.805] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0276.805] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0276.805] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=3746) returned 1 [0276.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0276.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6218020 [0277.328] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0277.328] GetLastError () returned 0x0 [0277.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0277.328] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0277.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x38c548, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terRLaOJV2Dtqoxu0p", lpUsedDefaultChar=0x0) returned 18 [0277.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0277.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0277.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0277.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.329] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0277.330] WriteFile (in: hFile=0x54c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x316fc18*=0xe65, lpOverlapped=0x0) returned 1 [0277.330] CloseHandle (hObject=0x54c) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0277.331] CryptDestroyKey (hKey=0x52615c8) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6900 | out: hHeap=0x310000) returned 1 [0277.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e20f0 | out: hHeap=0x310000) returned 1 [0277.331] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0277.331] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0277.331] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.331] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0277.458] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.458] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0277.458] CloseHandle (hObject=0x54c) returned 1 [0277.458] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0277.458] RmStartSession () returned 0x0 [0277.460] RmRegisterResources () returned 0x0 [0277.461] RmGetList () returned 0x0 [0277.495] RmShutdown () returned 0x0 [0279.047] RmEndSession () returned 0x0 [0279.048] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261388) returned 1 [0279.048] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0279.048] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF", dwFileAttributes=0x220) returned 1 [0279.048] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0279.048] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0279.048] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=7540) returned 1 [0279.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0279.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79ec020 [0279.741] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0279.741] ReadFile (in: hFile=0x54c, lpBuffer=0x79ec040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x79ec040*, lpNumberOfBytesRead=0x316fca4*=0x1d74, lpOverlapped=0x0) returned 1 [0279.742] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0279.743] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5281b60*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5281b60*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0279.743] WriteFile (in: hFile=0x54c, lpBuffer=0x5281b60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5281b60*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0279.743] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0279.743] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0279.743] WriteFile (in: hFile=0x54c, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0279.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79ec020 | out: hHeap=0x310000) returned 1 [0280.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5281b40 | out: hHeap=0x310000) returned 1 [0280.048] CloseHandle (hObject=0x54c) returned 1 [0280.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0280.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0280.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.048] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0280.049] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0280.049] GetLastError () returned 0x0 [0280.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0280.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c520, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.049] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7dc50 | out: hHeap=0x310000) returned 1 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0280.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.049] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0280.050] WriteFile (in: hFile=0x54c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe6f, lpOverlapped=0x0) returned 1 [0280.051] CloseHandle (hObject=0x54c) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.051] CryptDestroyKey (hKey=0x5261388) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5ee8 | out: hHeap=0x310000) returned 1 [0280.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1dd0 | out: hHeap=0x310000) returned 1 [0280.051] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0280.051] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0280.052] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.052] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0280.062] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.062] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0280.062] CloseHandle (hObject=0x54c) returned 1 [0280.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0280.063] RmStartSession () returned 0x0 [0280.064] RmRegisterResources () returned 0x0 [0280.064] RmGetList () returned 0x0 [0280.107] RmShutdown () returned 0x0 [0281.141] RmEndSession () returned 0x0 [0281.142] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x35d988) returned 1 [0281.142] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0281.142] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF", dwFileAttributes=0x220) returned 1 [0281.142] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0281.142] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0281.142] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=2016) returned 1 [0281.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c6d080 [0281.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7809020 [0281.803] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0281.803] ReadFile (in: hFile=0x54c, lpBuffer=0x7809040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x7809040*, lpNumberOfBytesRead=0x316fca4*=0x7e0, lpOverlapped=0x0) returned 1 [0281.804] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0281.804] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d0a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d0a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0281.805] WriteFile (in: hFile=0x54c, lpBuffer=0x6c6d0a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6c6d0a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0281.805] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0281.805] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0281.805] WriteFile (in: hFile=0x54c, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0281.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7809020 | out: hHeap=0x310000) returned 1 [0282.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c6d080 | out: hHeap=0x310000) returned 1 [0282.545] CloseHandle (hObject=0x54c) returned 1 [0282.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0282.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0282.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0282.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0282.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0282.545] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0282.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0282.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0282.546] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0282.546] GetLastError () returned 0x0 [0282.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0282.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x316fae0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fl", lpUsedDefaultChar=0x0) returned 2 [0282.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0282.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0282.547] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0282.548] WriteFile (in: hFile=0x54c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x316fc18*=0xe55, lpOverlapped=0x0) returned 1 [0282.548] CloseHandle (hObject=0x54c) returned 1 [0282.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0282.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0282.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0282.549] CryptDestroyKey (hKey=0x35d988) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c942a8 | out: hHeap=0x310000) returned 1 [0282.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1ce0 | out: hHeap=0x310000) returned 1 [0282.549] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0282.549] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0282.549] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.549] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0282.569] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.569] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0282.569] CloseHandle (hObject=0x54c) returned 1 [0282.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0282.569] RmStartSession () returned 0x0 [0282.571] RmRegisterResources () returned 0x0 [0282.572] RmGetList () returned 0x0 [0282.605] RmShutdown () returned 0x0 [0284.597] RmEndSession () returned 0x0 [0284.598] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x52610c8) returned 1 [0284.598] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0284.598] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x220) returned 1 [0284.598] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0284.598] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0284.598] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=22516) returned 1 [0284.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4ba7380 [0284.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79f5020 [0285.091] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0285.091] ReadFile (in: hFile=0x54c, lpBuffer=0x79f5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x79f5040*, lpNumberOfBytesRead=0x316fca4*=0x57f4, lpOverlapped=0x0) returned 1 [0285.093] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0285.093] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0285.093] WriteFile (in: hFile=0x54c, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0285.093] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0285.093] WriteFile (in: hFile=0x54c, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0285.093] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0285.094] WriteFile (in: hFile=0x54c, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0285.094] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0285.094] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0285.094] WriteFile (in: hFile=0x54c, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0285.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79f5020 | out: hHeap=0x310000) returned 1 [0285.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba7380 | out: hHeap=0x310000) returned 1 [0285.489] CloseHandle (hObject=0x54c) returned 1 [0285.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0285.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0285.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0285.490] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c16e8 [0285.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0285.490] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0285.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0285.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0285.491] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0285.491] GetLastError () returned 0x0 [0285.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x316fae0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0285.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0285.491] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0285.492] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0285.492] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0285.492] WriteFile (in: hFile=0x54c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe5f, lpOverlapped=0x0) returned 1 [0285.493] CloseHandle (hObject=0x54c) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c16e8 | out: hHeap=0x310000) returned 1 [0285.493] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0285.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0285.494] CryptDestroyKey (hKey=0x52610c8) returned 1 [0285.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0285.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94f20 | out: hHeap=0x310000) returned 1 [0285.494] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2960 | out: hHeap=0x310000) returned 1 [0285.494] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0285.494] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0285.494] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.494] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0286.021] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.021] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0286.021] CloseHandle (hObject=0x54c) returned 1 [0286.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0286.021] RmStartSession () returned 0x0 [0286.023] RmRegisterResources () returned 0x0 [0286.027] RmGetList () returned 0x0 [0286.239] RmShutdown () returned 0x0 [0289.708] RmEndSession () returned 0x0 [0290.082] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x5261748) returned 1 [0290.082] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0290.082] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF", dwFileAttributes=0x220) returned 1 [0290.082] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.083] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0290.083] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=40206) returned 1 [0290.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0290.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf6020 [0290.102] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0290.102] ReadFile (in: hFile=0x54c, lpBuffer=0x4cf6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x4cf6040*, lpNumberOfBytesRead=0x316fca4*=0x9d0e, lpOverlapped=0x0) returned 1 [0290.581] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0290.581] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0290.581] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0290.581] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0290.581] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0290.581] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0290.581] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0290.581] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0290.581] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0290.581] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0290.581] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0290.582] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0290.582] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0290.582] WriteFile (in: hFile=0x54c, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0290.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf6020 | out: hHeap=0x310000) returned 1 [0290.675] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0290.675] CloseHandle (hObject=0x54c) returned 1 [0290.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36b080 [0290.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0290.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0290.676] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0290.676] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0290.676] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0290.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0290.677] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0290.679] GetLastError () returned 0x0 [0290.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0290.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36b2b0 [0290.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x36b2b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0290.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6040710 | out: hHeap=0x310000) returned 1 [0290.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0290.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0290.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.679] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.680] WriteFile (in: hFile=0x54c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x316fc18*=0xe6f, lpOverlapped=0x0) returned 1 [0290.681] CloseHandle (hObject=0x54c) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36b2b0 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36b080 | out: hHeap=0x310000) returned 1 [0290.681] CryptDestroyKey (hKey=0x5261748) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c940e0 | out: hHeap=0x310000) returned 1 [0290.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e27d0 | out: hHeap=0x310000) returned 1 [0290.681] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0290.682] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.682] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.682] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0290.691] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.691] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0290.691] CloseHandle (hObject=0x54c) returned 1 [0290.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4f78 [0290.691] RmStartSession () returned 0x0 [0291.023] RmRegisterResources () returned 0x0 [0291.024] RmGetList () returned 0x0 [0291.929] RmShutdown () returned 0x0 [0292.436] RmEndSession () returned 0x0 [0292.650] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x316fda4 | out: phKey=0x316fda4*=0x35dd08) returned 1 [0292.650] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0292.650] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF", dwFileAttributes=0x220) returned 1 [0292.650] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0292.650] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316fc04*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x316fc04*=0x2000) returned 1 [0292.650] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x316fc9c | out: lpFileSize=0x316fc9c*=8070) returned 1 [0292.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0292.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ec020 [0292.670] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0292.670] ReadFile (in: hFile=0x5c8, lpBuffer=0x49ec040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x49ec040*, lpNumberOfBytesRead=0x316fca4*=0x1f86, lpOverlapped=0x0) returned 1 [0292.710] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc8c | out: lpNewFilePointer=0x0) returned 1 [0292.710] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x316fc18*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x316fc18*=0x2000) returned 1 [0292.710] WriteFile (in: hFile=0x5c8, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x316fca8*=0x2000, lpOverlapped=0x0) returned 1 [0292.710] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc94 | out: lpNewFilePointer=0x0) returned 1 [0292.710] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x316fca8*=0x200, lpOverlapped=0x0) returned 1 [0292.710] WriteFile (in: hFile=0x5c8, lpBuffer=0x316fc44*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x316fc44*, lpNumberOfBytesWritten=0x316fca8*=0x18, lpOverlapped=0x0) returned 1 [0292.710] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ec020 | out: hHeap=0x310000) returned 1 [0292.715] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0292.715] CloseHandle (hObject=0x5c8) returned 1 [0292.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0292.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c61a8 [0292.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0292.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4fb0 [0292.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c61a8 | out: hHeap=0x310000) returned 1 [0292.716] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5d20 [0292.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0292.717] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x316fa78 | out: lpSystemTimeAsFileTime=0x316fa78) [0292.717] GetLastError () returned 0x0 [0292.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0292.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x316fae0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0292.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0292.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.717] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0292.718] WriteFile (in: hFile=0x5c8, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x316fc18, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x316fc18*=0xe59, lpOverlapped=0x0) returned 1 [0292.719] CloseHandle (hObject=0x5c8) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5d20 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4fb0 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0292.719] CryptDestroyKey (hKey=0x35dd08) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4f78 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53069a8 | out: hHeap=0x310000) returned 1 [0292.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609fe8 | out: hHeap=0x310000) returned 1 [0292.719] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x316fdd8, lpCompletionKey=0x316fddc, lpOverlapped=0x316fdd4) returned 1 [0292.719] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0292.719] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fca8 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.719] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fca4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fca4*=0x18, lpOverlapped=0x0) returned 1 [0293.029] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fcb0 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.030] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x316fc98, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x316fc98*=0x18, lpOverlapped=0x0) returned 1 [0293.030] CloseHandle (hObject=0x5c8) returned 1 [0293.030] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5568 [0293.030] RmStartSession () returned 0x0 [0293.657] RmRegisterResources () returned 0x0 [0293.658] RmGetList () returned 0x0 [0295.589] RmShutdown () Thread: id = 8 os_tid = 0x1098 [0068.587] GetLastError () returned 0x57 [0068.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x3490c0 [0068.587] SetLastError (dwErrCode=0x57) [0068.587] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0078.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0081.324] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0086.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0087.566] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0088.603] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0090.083] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0093.623] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0098.980] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0100.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0107.627] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0108.721] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0135.623] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0135.624] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.624] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0135.629] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.629] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0135.629] CloseHandle (hObject=0x5b8) returned 1 [0135.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x51e6d10 [0136.003] RmStartSession () returned 0x0 [0137.881] RmRegisterResources () returned 0x0 [0137.881] RmGetList () returned 0x0 [0140.192] RmShutdown () returned 0x0 [0141.293] RmEndSession () returned 0x0 [0141.294] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x35dd08) returned 1 [0141.294] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0141.294] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.294] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0141.294] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0141.294] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=80970) returned 1 [0141.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c920f0 [0141.295] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x695b020 [0141.846] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0141.846] ReadFile (in: hFile=0x640, lpBuffer=0x695b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x695b040*, lpNumberOfBytesRead=0x32afa64*=0x13c4a, lpOverlapped=0x0) returned 1 [0141.854] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0141.854] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.854] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.854] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.854] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.854] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.854] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.855] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.855] CryptEncrypt (in: hKey=0x35dd08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c92100*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0141.856] WriteFile (in: hFile=0x640, lpBuffer=0x5c92100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c92100*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0141.856] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0141.856] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0141.856] WriteFile (in: hFile=0x640, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0141.856] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x695b020 | out: hHeap=0x310000) returned 1 [0142.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c920f0 | out: hHeap=0x310000) returned 1 [0142.830] CloseHandle (hObject=0x640) returned 1 [0142.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0142.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0142.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0142.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0142.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0142.833] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1029\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0142.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0142.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0142.834] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0142.834] GetLastError () returned 0x0 [0142.834] SetLastError (dwErrCode=0x0) [0142.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0142.835] GetLastError () returned 0x0 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0142.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365868 [0142.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] GetLastError () returned 0x0 [0142.837] SetLastError (dwErrCode=0x0) [0142.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0142.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0142.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0142.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x38c340, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", lpUsedDefaultChar=0x0) returned 28 [0142.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0142.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0142.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0142.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39af68 [0142.838] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0142.839] WriteFile (in: hFile=0x640, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x32af9d8*=0xe6f, lpOverlapped=0x0) returned 1 [0142.845] CloseHandle (hObject=0x640) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39af68 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0142.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0142.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0142.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0142.847] CryptDestroyKey (hKey=0x35dd08) returned 1 [0142.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6d10 | out: hHeap=0x310000) returned 1 [0142.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0142.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365ae8 | out: hHeap=0x310000) returned 1 [0142.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0142.847] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0142.847] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.847] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0142.887] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.887] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0142.887] CloseHandle (hObject=0x640) returned 1 [0142.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0142.888] RmStartSession () returned 0x0 [0142.891] RmRegisterResources () returned 0x0 [0142.896] RmGetList () returned 0x0 [0144.246] RmShutdown () returned 0x0 [0148.190] RmEndSession () returned 0x0 [0148.191] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52617c8) returned 1 [0148.191] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0148.191] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x80) returned 1 [0148.191] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0148.191] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0148.192] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=10125) returned 1 [0148.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ad9f8 [0148.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6734020 [0148.703] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0148.703] ReadFile (in: hFile=0x640, lpBuffer=0x6734040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6734040*, lpNumberOfBytesRead=0x32afa64*=0x278d, lpOverlapped=0x0) returned 1 [0148.716] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0148.716] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0148.716] WriteFile (in: hFile=0x640, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0148.716] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0148.716] WriteFile (in: hFile=0x640, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0148.716] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0148.716] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0148.717] WriteFile (in: hFile=0x640, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0148.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6734020 | out: hHeap=0x310000) returned 1 [0151.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ad9f8 | out: hHeap=0x310000) returned 1 [0151.570] CloseHandle (hObject=0x640) returned 1 [0151.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0151.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0151.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3996c0 [0151.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1fd0 [0151.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0151.573] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1041\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0151.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398ed8 [0151.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0151.573] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0151.573] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.574] SetLastError (dwErrCode=0x0) [0151.574] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3a8 [0151.575] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] GetLastError () returned 0x0 [0151.575] SetLastError (dwErrCode=0x0) [0151.575] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0151.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0151.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0151.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c4d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0151.575] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3a8 | out: hHeap=0x310000) returned 1 [0151.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0151.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0151.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39ee0 [0151.576] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0151.577] WriteFile (in: hFile=0x640, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x32af9d8*=0xe69, lpOverlapped=0x0) returned 1 [0151.577] CloseHandle (hObject=0x640) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39ee0 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1fd0 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3996c0 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0151.578] CryptDestroyKey (hKey=0x52617c8) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a88 | out: hHeap=0x310000) returned 1 [0151.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18d90 | out: hHeap=0x310000) returned 1 [0151.578] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0151.578] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0151.578] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.578] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0151.580] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.580] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0151.580] CloseHandle (hObject=0x640) returned 1 [0151.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0151.581] RmStartSession () returned 0x0 [0151.584] RmRegisterResources () returned 0x0 [0151.588] RmGetList () returned 0x0 [0153.539] RmShutdown () returned 0x0 [0154.399] RmEndSession () returned 0x0 [0154.957] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52614c8) returned 1 [0154.957] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0154.957] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico", dwFileAttributes=0x80) returned 1 [0154.958] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0154.958] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0154.958] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=894) returned 1 [0154.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0154.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57f2020 [0154.983] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0154.983] ReadFile (in: hFile=0x640, lpBuffer=0x57f2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x57f2040*, lpNumberOfBytesRead=0x32afa64*=0x37e, lpOverlapped=0x0) returned 1 [0155.015] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0155.015] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0155.015] WriteFile (in: hFile=0x640, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0155.016] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0155.016] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0155.016] WriteFile (in: hFile=0x640, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0155.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57f2020 | out: hHeap=0x310000) returned 1 [0155.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0155.023] CloseHandle (hObject=0x640) returned 1 [0155.227] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0155.228] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0b58 [0155.228] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0155.228] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0155.228] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0155.228] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0155.229] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0155.229] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0155.229] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0155.229] GetLastError () returned 0x0 [0155.229] SetLastError (dwErrCode=0x0) [0155.229] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0155.229] GetLastError () returned 0x0 [0155.229] SetLastError (dwErrCode=0x0) [0155.229] GetLastError () returned 0x0 [0155.230] SetLastError (dwErrCode=0x0) [0155.230] GetLastError () returned 0x0 [0155.230] SetLastError (dwErrCode=0x0) [0155.230] GetLastError () returned 0x0 [0155.230] SetLastError (dwErrCode=0x0) [0155.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0155.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rdv", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0155.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rdv", cchWideChar=3, lpMultiByteStr=0x32af8a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rdv", lpUsedDefaultChar=0x0) returned 3 [0155.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0155.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0155.230] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0155.236] WriteFile (in: hFile=0x640, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x32af9d8*=0xe56, lpOverlapped=0x0) returned 1 [0155.237] CloseHandle (hObject=0x640) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0155.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0155.245] CryptDestroyKey (hKey=0x52614c8) returned 1 [0155.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0155.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060b10 | out: hHeap=0x310000) returned 1 [0155.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5800 | out: hHeap=0x310000) returned 1 [0155.424] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0155.425] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0155.425] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.425] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0155.457] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.457] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0155.457] CloseHandle (hObject=0x5c8) returned 1 [0155.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0155.457] RmStartSession () returned 0x0 [0156.349] RmRegisterResources () returned 0x0 [0156.352] RmGetList () returned 0x0 [0157.469] RmShutdown () returned 0x0 [0159.059] RmEndSession () returned 0x0 [0159.185] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52616c8) returned 1 [0159.185] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0159.186] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi", dwFileAttributes=0x80) returned 1 [0159.187] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0159.187] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0159.187] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=872448) returned 1 [0159.187] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc4670 [0159.188] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d30020 [0159.211] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0159.211] ReadFile (in: hFile=0x5b0, lpBuffer=0x4d30040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x4d30040*, lpNumberOfBytesRead=0x32afa64*=0xd5000, lpOverlapped=0x0) returned 1 [0159.435] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0159.435] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.435] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.436] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.436] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.437] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.437] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.438] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.438] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.439] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.439] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.440] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.440] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.441] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.441] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.442] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.442] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.443] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.444] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.444] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.445] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.445] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.446] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.446] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.447] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.447] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.448] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.448] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.449] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.449] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.449] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.449] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.449] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.449] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.450] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.450] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.451] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.452] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0159.452] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0159.452] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0159.452] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0159.452] WriteFile (in: hFile=0x5b0, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0159.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d30020 | out: hHeap=0x310000) returned 1 [0159.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc4670 | out: hHeap=0x310000) returned 1 [0159.483] CloseHandle (hObject=0x5b0) returned 1 [0159.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0159.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0159.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0159.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0159.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0159.501] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0159.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0159.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3a8 [0159.502] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0159.502] GetLastError () returned 0x0 [0159.502] SetLastError (dwErrCode=0x0) [0159.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0159.502] GetLastError () returned 0x0 [0159.502] SetLastError (dwErrCode=0x0) [0159.502] GetLastError () returned 0x0 [0159.502] SetLastError (dwErrCode=0x0) [0159.502] GetLastError () returned 0x0 [0159.502] SetLastError (dwErrCode=0x0) [0159.502] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.503] GetLastError () returned 0x0 [0159.503] SetLastError (dwErrCode=0x0) [0159.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0159.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0159.504] GetLastError () returned 0x0 [0159.504] SetLastError (dwErrCode=0x0) [0159.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0159.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0159.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x38c4d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r8qa7ZyzJ1OtQOBkD", lpUsedDefaultChar=0x0) returned 17 [0159.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0159.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0159.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0159.504] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0159.504] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0159.505] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x32af9d8*=0xe64, lpOverlapped=0x0) returned 1 [0159.506] CloseHandle (hObject=0x5b0) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3a8 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0159.507] CryptDestroyKey (hKey=0x52616c8) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a28c0 | out: hHeap=0x310000) returned 1 [0159.507] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5f30 | out: hHeap=0x310000) returned 1 [0159.507] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0159.507] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0159.507] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.507] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0159.509] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.509] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0159.509] CloseHandle (hObject=0x5b0) returned 1 [0159.509] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0159.509] RmStartSession () returned 0x0 [0159.512] RmRegisterResources () returned 0x0 [0159.516] RmGetList () returned 0x0 [0160.367] RmShutdown () returned 0x0 [0161.133] RmEndSession () returned 0x0 [0161.134] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52613c8) returned 1 [0161.134] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0161.134] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0161.135] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0161.135] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0161.135] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=38898) returned 1 [0161.135] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bbc5e8 [0161.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6bf0020 [0161.316] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0161.316] ReadFile (in: hFile=0x5b0, lpBuffer=0x6bf0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6bf0040*, lpNumberOfBytesRead=0x32afa64*=0x97f2, lpOverlapped=0x0) returned 1 [0161.331] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0161.331] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0161.331] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0161.331] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0161.331] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0161.331] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0161.331] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0161.332] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0161.332] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0161.332] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bbc600*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0161.332] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bbc600*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4bbc600*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0161.332] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0161.332] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0161.332] WriteFile (in: hFile=0x5b0, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0161.332] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6bf0020 | out: hHeap=0x310000) returned 1 [0161.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbc5e8 | out: hHeap=0x310000) returned 1 [0161.337] CloseHandle (hObject=0x5b0) returned 1 [0161.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0161.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0161.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399820 [0161.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0161.339] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0161.339] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\UiInfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.340] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3999d8 [0161.340] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0161.340] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.340] SetLastError (dwErrCode=0x0) [0161.340] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0161.341] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.341] SetLastError (dwErrCode=0x0) [0161.341] GetLastError () returned 0x0 [0161.342] SetLastError (dwErrCode=0x0) [0161.342] GetLastError () returned 0x0 [0161.342] SetLastError (dwErrCode=0x0) [0161.342] GetLastError () returned 0x0 [0161.342] SetLastError (dwErrCode=0x0) [0161.342] GetLastError () returned 0x0 [0161.342] SetLastError (dwErrCode=0x0) [0161.342] GetLastError () returned 0x0 [0161.342] SetLastError (dwErrCode=0x0) [0161.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0161.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0161.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0161.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x38c3e0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asZJGyY6zFo1elxK4hBU7cY", lpUsedDefaultChar=0x0) returned 23 [0161.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0161.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0161.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0161.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0161.342] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0161.343] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x32af9d8*=0xe6a, lpOverlapped=0x0) returned 1 [0161.344] CloseHandle (hObject=0x5b0) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3999d8 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399820 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0161.344] CryptDestroyKey (hKey=0x52613c8) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0161.344] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0161.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365368 | out: hHeap=0x310000) returned 1 [0161.345] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0161.345] CreateFileW (lpFileName="C:\\\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0161.345] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.345] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0161.351] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.351] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0161.351] CloseHandle (hObject=0x5b0) returned 1 [0161.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d98 [0161.351] RmStartSession () returned 0x0 [0162.498] RmRegisterResources () returned 0x0 [0162.507] RmGetList () returned 0x0 [0163.046] RmShutdown () returned 0x0 [0164.257] RmEndSession () returned 0x0 [0164.695] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261348) returned 1 [0164.695] GetFileAttributesW (lpFileName="C:\\\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0164.695] SetFileAttributesW (lpFileName="C:\\\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x20) returned 1 [0164.695] CreateFileW (lpFileName="C:\\\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0164.695] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0164.696] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0164.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0164.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5906020 [0164.715] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0164.715] ReadFile (in: hFile=0x618, lpBuffer=0x5906040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x5906040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0164.766] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0164.766] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.766] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.766] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.766] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.766] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.766] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.767] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0164.767] WriteFile (in: hFile=0x618, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0164.768] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0164.768] WriteFile (in: hFile=0x618, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0164.768] WriteFile (in: hFile=0x618, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0164.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5906020 | out: hHeap=0x310000) returned 1 [0164.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0164.773] CloseHandle (hObject=0x618) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0164.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399878 [0164.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0164.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0164.776] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399878 | out: hHeap=0x310000) returned 1 [0164.776] MoveFileExW (lpExistingFileName="C:\\\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="C:\\\\Logs\\HardwareEvents.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\hardwareevents.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0164.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0164.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0164.776] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] GetLastError () returned 0x0 [0164.778] SetLastError (dwErrCode=0x0) [0164.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0164.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VNUF", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0164.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VNUF", cchWideChar=4, lpMultiByteStr=0x32af8a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VNUF", lpUsedDefaultChar=0x0) returned 4 [0164.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0164.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0164.778] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0165.507] WriteFile (in: hFile=0x5e8, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x32af9d8*=0xe57, lpOverlapped=0x0) returned 1 [0165.508] CloseHandle (hObject=0x5e8) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0165.509] CryptDestroyKey (hKey=0x5261348) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d98 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397768 | out: hHeap=0x310000) returned 1 [0165.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18bb0 | out: hHeap=0x310000) returned 1 [0165.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0165.509] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0165.510] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.510] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0165.512] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.512] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0165.512] CloseHandle (hObject=0x5e8) returned 1 [0165.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x52032c0 [0165.512] RmStartSession () returned 0x0 [0165.775] RmRegisterResources () returned 0x0 [0165.779] RmGetList () returned 0x0 [0166.641] RmShutdown () returned 0x0 [0170.638] RmEndSession () returned 0x0 [0170.747] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261848) returned 1 [0170.748] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0170.748] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x20) returned 1 [0170.748] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0170.748] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0170.748] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0170.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5337020 [0170.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6d9b020 [0170.765] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0170.765] ReadFile (in: hFile=0x69c, lpBuffer=0x6d9b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6d9b040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0170.796] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0170.796] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.796] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.796] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.796] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.796] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.796] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.796] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.796] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5337040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x5337040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5337040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0170.797] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0170.797] WriteFile (in: hFile=0x69c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0170.798] WriteFile (in: hFile=0x69c, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0170.798] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6d9b020 | out: hHeap=0x310000) returned 1 [0170.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5337020 | out: hHeap=0x310000) returned 1 [0170.803] CloseHandle (hObject=0x69c) returned 1 [0171.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0171.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bba990 [0171.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322108 [0171.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bbb9f8 [0171.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba990 | out: hHeap=0x310000) returned 1 [0171.104] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53219e8 [0171.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0171.104] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3de0 [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.105] SetLastError (dwErrCode=0x0) [0171.105] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0171.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.106] GetLastError () returned 0x0 [0171.106] SetLastError (dwErrCode=0x0) [0171.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0171.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0171.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3de0 | out: hHeap=0x310000) returned 1 [0171.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0171.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0171.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x38c160, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eccP6SvgOOuCqWKgmyr9SIud", lpUsedDefaultChar=0x0) returned 24 [0171.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0171.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0171.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0171.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0171.107] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0171.108] WriteFile (in: hFile=0x4d4, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x32af9d8*=0xe6b, lpOverlapped=0x0) returned 1 [0171.109] CloseHandle (hObject=0x4d4) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53219e8 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbb9f8 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322108 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0171.109] CryptDestroyKey (hKey=0x5261848) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52032c0 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cd30 | out: hHeap=0x310000) returned 1 [0171.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19380 | out: hHeap=0x310000) returned 1 [0171.109] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0171.109] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0171.110] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.110] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0171.123] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.123] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0171.123] CloseHandle (hObject=0x4d4) returned 1 [0171.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0171.123] RmStartSession () returned 0x0 [0171.126] RmRegisterResources () returned 0x0 [0171.130] RmGetList () returned 0x0 [0171.767] RmShutdown () returned 0x0 [0172.071] RmEndSession () returned 0x0 [0172.072] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261ac8) returned 1 [0172.072] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0172.072] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0172.072] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0172.072] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0172.072] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0172.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5043aa8 [0172.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6e9c020 [0172.536] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0172.536] ReadFile (in: hFile=0x4d4, lpBuffer=0x6e9c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6e9c040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0172.538] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0172.538] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.539] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.540] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.540] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.540] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5043ac0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0172.540] WriteFile (in: hFile=0x4d4, lpBuffer=0x5043ac0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5043ac0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0172.540] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x4d4, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0172.540] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6e9c020 | out: hHeap=0x310000) returned 1 [0174.080] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5043aa8 | out: hHeap=0x310000) returned 1 [0174.081] CloseHandle (hObject=0x4d4) returned 1 [0174.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0174.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321658 [0174.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0174.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53221a0 [0174.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321658 | out: hHeap=0x310000) returned 1 [0174.084] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0174.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0174.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0174.085] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0174.085] GetLastError () returned 0x0 [0174.085] SetLastError (dwErrCode=0x0) [0174.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0174.085] GetLastError () returned 0x0 [0174.085] SetLastError (dwErrCode=0x0) [0174.085] GetLastError () returned 0x0 [0174.085] SetLastError (dwErrCode=0x0) [0174.085] GetLastError () returned 0x0 [0174.085] SetLastError (dwErrCode=0x0) [0174.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0174.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0174.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x32af8a0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dz", lpUsedDefaultChar=0x0) returned 2 [0174.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0174.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0174.086] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0174.086] WriteFile (in: hFile=0x4d4, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x32af9d8*=0xe55, lpOverlapped=0x0) returned 1 [0174.087] CloseHandle (hObject=0x4d4) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53221a0 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0174.088] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0174.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea148 | out: hHeap=0x310000) returned 1 [0174.089] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e67e0 | out: hHeap=0x310000) returned 1 [0174.089] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0174.089] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0174.089] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.089] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0174.105] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.105] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0174.105] CloseHandle (hObject=0x4d4) returned 1 [0174.105] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3e68 [0174.105] RmStartSession () returned 0x0 [0174.107] RmRegisterResources () returned 0x0 [0174.111] RmGetList () returned 0x0 [0174.889] RmShutdown () returned 0x0 [0176.996] RmEndSession () returned 0x0 [0177.274] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261a08) returned 1 [0177.274] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0177.274] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0177.335] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0177.335] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0177.335] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0177.335] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5e3d008 [0177.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677e020 [0177.354] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0177.354] ReadFile (in: hFile=0x4d4, lpBuffer=0x677e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x677e040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0177.400] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0177.400] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.400] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.400] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.400] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.400] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.401] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0177.401] WriteFile (in: hFile=0x4d4, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0177.402] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0177.402] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0177.402] WriteFile (in: hFile=0x4d4, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0177.402] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677e020 | out: hHeap=0x310000) returned 1 [0177.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e3d008 | out: hHeap=0x310000) returned 1 [0177.534] CloseHandle (hObject=0x4d4) returned 1 [0177.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0177.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322c50 [0177.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0177.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53231a8 [0177.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322c50 | out: hHeap=0x310000) returned 1 [0177.537] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0177.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0177.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0177.537] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0177.537] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] GetLastError () returned 0x0 [0177.538] SetLastError (dwErrCode=0x0) [0177.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0177.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x32af8a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mLGY6f92w4A", lpUsedDefaultChar=0x0) returned 11 [0177.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0177.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0177.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0177.539] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0177.539] WriteFile (in: hFile=0x4d4, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x32af9d8*=0xe5e, lpOverlapped=0x0) returned 1 [0177.540] CloseHandle (hObject=0x4d4) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53231a8 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0177.541] CryptDestroyKey (hKey=0x5261a08) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3e68 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea478 | out: hHeap=0x310000) returned 1 [0177.541] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6060 | out: hHeap=0x310000) returned 1 [0177.541] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0177.541] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0177.541] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.541] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0177.543] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.543] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0177.543] CloseHandle (hObject=0x4d4) returned 1 [0177.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0177.543] RmStartSession () returned 0x0 [0177.982] RmRegisterResources () returned 0x0 [0177.986] RmGetList () returned 0x0 [0178.163] RmShutdown () returned 0x0 [0178.546] RmEndSession () returned 0x0 [0178.547] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260c08) returned 1 [0178.547] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0178.547] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0178.547] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0178.547] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0178.547] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0178.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0178.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677f020 [0178.671] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0178.671] ReadFile (in: hFile=0x668, lpBuffer=0x677f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x677f040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0178.673] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0178.673] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.673] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.673] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.673] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.673] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.673] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.673] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.673] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0178.674] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0178.674] WriteFile (in: hFile=0x668, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0178.675] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677f020 | out: hHeap=0x310000) returned 1 [0178.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0178.760] CloseHandle (hObject=0x668) returned 1 [0178.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0178.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53231a8 [0178.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0178.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322c50 [0178.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53231a8 | out: hHeap=0x310000) returned 1 [0178.763] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0178.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0178.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0178.764] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364f78 [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0178.764] GetLastError () returned 0x0 [0178.764] SetLastError (dwErrCode=0x0) [0178.764] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b500 [0178.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] GetLastError () returned 0x0 [0178.765] SetLastError (dwErrCode=0x0) [0178.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364f78 | out: hHeap=0x310000) returned 1 [0178.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0178.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x38c480, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z6SlG4j98JbFmSQSeg", lpUsedDefaultChar=0x0) returned 18 [0178.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0178.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0178.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0178.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0178.765] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0178.766] WriteFile (in: hFile=0x668, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x32af9d8*=0xe65, lpOverlapped=0x0) returned 1 [0178.767] CloseHandle (hObject=0x668) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322c50 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0178.768] CryptDestroyKey (hKey=0x5260c08) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae90 | out: hHeap=0x310000) returned 1 [0178.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6970 | out: hHeap=0x310000) returned 1 [0178.769] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0178.769] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0178.769] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.769] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0178.782] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.782] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0178.782] CloseHandle (hObject=0x668) returned 1 [0178.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0178.782] RmStartSession () returned 0x0 [0178.785] RmRegisterResources () returned 0x0 [0178.788] RmGetList () returned 0x0 [0179.261] RmShutdown () returned 0x0 [0179.909] RmEndSession () returned 0x0 [0180.120] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261008) returned 1 [0180.120] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0180.120] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x20) returned 1 [0180.121] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0180.121] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0180.121] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0180.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0180.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x666d020 [0180.137] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0180.137] ReadFile (in: hFile=0x668, lpBuffer=0x666d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x666d040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0180.196] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0180.196] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.196] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.197] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.197] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.197] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.197] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.197] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.197] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.197] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.197] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.197] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.197] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.198] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.198] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.198] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.198] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.198] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0180.198] WriteFile (in: hFile=0x668, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0180.198] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0180.198] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0180.198] WriteFile (in: hFile=0x668, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0180.199] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x666d020 | out: hHeap=0x310000) returned 1 [0180.203] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0180.203] CloseHandle (hObject=0x668) returned 1 [0180.206] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0180.206] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322c50 [0180.206] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0180.206] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322ce8 [0180.206] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322c50 | out: hHeap=0x310000) returned 1 [0180.206] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0180.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0180.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0180.207] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364f78 [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] GetLastError () returned 0x0 [0180.207] SetLastError (dwErrCode=0x0) [0180.207] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b928 [0180.208] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.208] GetLastError () returned 0x0 [0180.208] SetLastError (dwErrCode=0x0) [0180.209] GetLastError () returned 0x0 [0180.209] SetLastError (dwErrCode=0x0) [0180.209] GetLastError () returned 0x0 [0180.209] SetLastError (dwErrCode=0x0) [0180.209] GetLastError () returned 0x0 [0180.209] SetLastError (dwErrCode=0x0) [0180.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364f78 | out: hHeap=0x310000) returned 1 [0180.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0180.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x38c3e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LEa8akVxyvJo8s5UpDdBd", lpUsedDefaultChar=0x0) returned 21 [0180.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b928 | out: hHeap=0x310000) returned 1 [0180.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0180.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0180.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0180.209] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0180.210] WriteFile (in: hFile=0x668, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x32af9d8*=0xe68, lpOverlapped=0x0) returned 1 [0180.211] CloseHandle (hObject=0x668) returned 1 [0180.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0180.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0180.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0180.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0180.211] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322ce8 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0180.212] CryptDestroyKey (hKey=0x5261008) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eab60 | out: hHeap=0x310000) returned 1 [0180.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e69c0 | out: hHeap=0x310000) returned 1 [0180.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0180.212] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0180.212] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.212] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0180.872] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.872] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0180.872] CloseHandle (hObject=0x668) returned 1 [0180.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0180.872] RmStartSession () returned 0x0 [0181.731] RmRegisterResources () returned 0x0 [0181.735] RmGetList () returned 0x0 [0182.896] RmShutdown () returned 0x0 [0185.831] RmEndSession () returned 0x0 [0186.281] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261008) returned 1 [0186.282] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0186.282] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0186.282] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0186.282] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0186.282] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0186.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5411c60 [0186.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b6020 [0186.300] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0186.300] ReadFile (in: hFile=0x668, lpBuffer=0x64b6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x64b6040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0186.394] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0186.394] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.395] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.395] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.395] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.395] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.395] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.395] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.395] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.402] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.402] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.402] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.402] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.402] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.403] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0186.403] WriteFile (in: hFile=0x668, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0186.403] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0186.403] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0186.403] WriteFile (in: hFile=0x668, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0186.404] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b6020 | out: hHeap=0x310000) returned 1 [0186.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5411c60 | out: hHeap=0x310000) returned 1 [0186.410] CloseHandle (hObject=0x668) returned 1 [0186.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0186.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0186.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4880 [0186.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0186.724] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0186.724] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0186.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0186.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0186.725] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.725] GetLastError () returned 0x0 [0186.725] SetLastError (dwErrCode=0x0) [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] GetLastError () returned 0x0 [0186.726] SetLastError (dwErrCode=0x0) [0186.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0186.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0186.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x32af8a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K5peP9WcLDHI", lpUsedDefaultChar=0x0) returned 12 [0186.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0186.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0186.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0186.726] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0186.727] WriteFile (in: hFile=0x69c, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x32af9d8*=0xe5f, lpOverlapped=0x0) returned 1 [0186.728] CloseHandle (hObject=0x69c) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4880 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0186.729] CryptDestroyKey (hKey=0x5261008) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eabe8 | out: hHeap=0x310000) returned 1 [0186.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6d30 | out: hHeap=0x310000) returned 1 [0186.729] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0186.729] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0186.730] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.730] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0186.735] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.735] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0186.735] CloseHandle (hObject=0x69c) returned 1 [0186.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0186.735] RmStartSession () returned 0x0 [0186.949] RmRegisterResources () returned 0x0 [0186.953] RmGetList () returned 0x0 [0187.217] RmShutdown () returned 0x0 [0190.066] RmEndSession () returned 0x0 [0190.067] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261008) returned 1 [0190.067] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0190.067] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x20) returned 1 [0190.067] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0190.067] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0190.067] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=69632) returned 1 [0190.067] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd4050 [0190.068] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6aa1020 [0190.286] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0190.286] ReadFile (in: hFile=0x69c, lpBuffer=0x6aa1040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6aa1040*, lpNumberOfBytesRead=0x32afa64*=0x11000, lpOverlapped=0x0) returned 1 [0190.288] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0190.288] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.289] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.289] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.289] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.289] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.289] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.289] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.290] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.290] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.290] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.290] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.290] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0190.290] WriteFile (in: hFile=0x69c, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0190.290] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0190.290] WriteFile (in: hFile=0x69c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0190.291] WriteFile (in: hFile=0x69c, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0190.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6aa1020 | out: hHeap=0x310000) returned 1 [0190.317] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd4050 | out: hHeap=0x310000) returned 1 [0190.317] CloseHandle (hObject=0x69c) returned 1 [0190.320] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.320] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5323110 [0190.320] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0190.320] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327e40 [0190.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5323110 | out: hHeap=0x310000) returned 1 [0190.320] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0190.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0190.321] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.321] SetLastError (dwErrCode=0x0) [0190.321] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b928 [0190.322] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.322] SetLastError (dwErrCode=0x0) [0190.322] GetLastError () returned 0x0 [0190.323] SetLastError (dwErrCode=0x0) [0190.323] GetLastError () returned 0x0 [0190.323] SetLastError (dwErrCode=0x0) [0190.323] GetLastError () returned 0x0 [0190.323] SetLastError (dwErrCode=0x0) [0190.323] GetLastError () returned 0x0 [0190.323] SetLastError (dwErrCode=0x0) [0190.323] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0190.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0190.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0190.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x38c3e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tRdDQltWN4PVKdRqXUoqyy", lpUsedDefaultChar=0x0) returned 22 [0190.323] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b928 | out: hHeap=0x310000) returned 1 [0190.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0190.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540e528 [0190.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0190.323] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0190.324] WriteFile (in: hFile=0x69c, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x32af9d8*=0xe69, lpOverlapped=0x0) returned 1 [0190.336] CloseHandle (hObject=0x69c) returned 1 [0190.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0190.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0190.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327e40 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.338] CryptDestroyKey (hKey=0x5261008) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eac70 | out: hHeap=0x310000) returned 1 [0190.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365778 | out: hHeap=0x310000) returned 1 [0190.338] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0190.338] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0190.338] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.338] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0190.413] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.413] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0190.413] CloseHandle (hObject=0x69c) returned 1 [0190.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61369a0 [0190.413] RmStartSession () returned 0x0 [0190.448] RmRegisterResources () returned 0x0 [0190.451] RmGetList () returned 0x0 [0191.775] RmShutdown () returned 0x0 [0194.657] RmEndSession () returned 0x0 [0194.659] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261908) returned 1 [0194.659] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0194.659] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x20) returned 1 [0194.659] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0194.659] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0194.659] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=1052672) returned 1 [0194.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b7cf48 [0194.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d34020 [0194.986] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0194.986] ReadFile (in: hFile=0x69c, lpBuffer=0x4d34040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x4d34040*, lpNumberOfBytesRead=0x32afa64*=0x100000, lpOverlapped=0x0) returned 1 [0194.995] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0194.995] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.995] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.996] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.996] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.997] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.997] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.998] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0194.999] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0194.999] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.000] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.000] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.001] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.001] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.002] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.002] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.003] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.003] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.004] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.004] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.005] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.005] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.006] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.006] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.007] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.008] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.009] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.010] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.011] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.011] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.012] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.012] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.013] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.013] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.014] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0195.014] WriteFile (in: hFile=0x69c, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0195.014] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0195.014] WriteFile (in: hFile=0x69c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0195.014] WriteFile (in: hFile=0x69c, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0195.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d34020 | out: hHeap=0x310000) returned 1 [0195.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7cf48 | out: hHeap=0x310000) returned 1 [0195.991] CloseHandle (hObject=0x69c) returned 1 [0195.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0195.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5425888 [0195.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7afc8 [0195.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x5424e60 [0195.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5425888 | out: hHeap=0x310000) returned 1 [0195.992] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0195.992] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b790e0 [0195.992] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0195.992] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0195.992] GetLastError () returned 0x0 [0195.992] SetLastError (dwErrCode=0x0) [0195.992] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc010 [0195.992] GetLastError () returned 0x0 [0195.992] SetLastError (dwErrCode=0x0) [0195.992] GetLastError () returned 0x0 [0195.992] SetLastError (dwErrCode=0x0) [0195.992] GetLastError () returned 0x0 [0195.992] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0195.993] GetLastError () returned 0x0 [0195.993] SetLastError (dwErrCode=0x0) [0195.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc010 | out: hHeap=0x310000) returned 1 [0195.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0195.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x32af8a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2gHNuRbsv", lpUsedDefaultChar=0x0) returned 9 [0195.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0195.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0195.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0195.993] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0195.994] WriteFile (in: hFile=0x69c, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x32af9d8*=0xe5c, lpOverlapped=0x0) returned 1 [0195.995] CloseHandle (hObject=0x69c) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b790e0 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5424e60 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7afc8 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0195.995] CryptDestroyKey (hKey=0x5261908) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61369a0 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390608 | out: hHeap=0x310000) returned 1 [0195.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44b28 | out: hHeap=0x310000) returned 1 [0195.995] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0195.995] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0195.996] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.996] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0196.023] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.023] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0196.023] CloseHandle (hObject=0x69c) returned 1 [0196.023] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0196.023] RmStartSession () returned 0x0 [0196.108] RmRegisterResources () returned 0x0 [0196.113] RmGetList () returned 0x0 [0196.925] RmShutdown () returned 0x0 [0200.917] RmEndSession () returned 0x0 [0200.920] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52614c8) returned 1 [0200.920] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0200.920] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0200.920] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.920] CryptDestroyKey (hKey=0x52614c8) returned 1 [0200.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0200.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92430 | out: hHeap=0x310000) returned 1 [0200.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07b50 | out: hHeap=0x310000) returned 1 [0200.920] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0200.920] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0200.921] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.921] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0200.962] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.962] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0200.962] CloseHandle (hObject=0x69c) returned 1 [0200.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5ce0 [0200.962] RmStartSession () returned 0x0 [0200.965] RmRegisterResources () returned 0x0 [0200.969] RmGetList () returned 0x0 [0204.003] RmShutdown () returned 0x0 [0208.228] RmEndSession () returned 0x0 [0208.229] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52614c8) returned 1 [0208.229] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0208.229] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui", dwFileAttributes=0x20) returned 0 [0208.229] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.229] CryptDestroyKey (hKey=0x52614c8) returned 1 [0208.229] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5ce0 | out: hHeap=0x310000) returned 1 [0208.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c930a8 | out: hHeap=0x310000) returned 1 [0208.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07f60 | out: hHeap=0x310000) returned 1 [0208.230] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0208.230] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0208.230] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.230] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0208.268] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.268] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0208.269] CloseHandle (hObject=0x69c) returned 1 [0208.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ebde0 [0208.269] RmStartSession () returned 0x0 [0208.878] RmRegisterResources () returned 0x0 [0208.882] RmGetList () returned 0x0 [0209.371] RmShutdown () returned 0x0 [0211.514] RmEndSession () returned 0x0 [0211.515] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x35dd08) returned 1 [0211.515] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0211.516] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", dwFileAttributes=0x20) returned 0 [0211.516] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.516] CryptDestroyKey (hKey=0x35dd08) returned 1 [0211.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ebde0 | out: hHeap=0x310000) returned 1 [0211.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc158 | out: hHeap=0x310000) returned 1 [0211.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5470 | out: hHeap=0x310000) returned 1 [0211.516] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0211.516] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0211.516] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.516] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0211.533] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.533] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0211.533] CloseHandle (hObject=0x69c) returned 1 [0211.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3908e8 [0211.533] RmStartSession () returned 0x0 [0211.537] RmRegisterResources () returned 0x0 [0212.028] RmGetList () returned 0x0 [0212.078] RmShutdown () returned 0x0 [0213.238] RmEndSession () returned 0x0 [0213.716] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261188) returned 1 [0213.716] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0213.716] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", dwFileAttributes=0x20) returned 0 [0213.716] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.718] CryptDestroyKey (hKey=0x5261188) returned 1 [0213.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3908e8 | out: hHeap=0x310000) returned 1 [0213.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc940 | out: hHeap=0x310000) returned 1 [0213.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5880 | out: hHeap=0x310000) returned 1 [0213.718] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0213.718] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0213.718] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.719] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0213.753] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.753] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0213.753] CloseHandle (hObject=0x54c) returned 1 [0213.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc5d0 [0213.753] RmStartSession () returned 0x0 [0213.761] RmRegisterResources () returned 0x0 [0213.763] RmGetList () returned 0x0 [0213.945] RmShutdown () returned 0x0 [0216.400] RmEndSession () returned 0x0 [0216.454] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260c48) returned 1 [0216.454] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0216.454] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml", dwFileAttributes=0x20) returned 0 [0216.454] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.454] CryptDestroyKey (hKey=0x5260c48) returned 1 [0216.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc5d0 | out: hHeap=0x310000) returned 1 [0216.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0216.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5380 | out: hHeap=0x310000) returned 1 [0216.455] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0216.455] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0216.455] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.455] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0216.512] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.512] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0216.512] CloseHandle (hObject=0x55c) returned 1 [0216.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd3a0 [0216.512] RmStartSession () returned 0x0 [0216.515] RmRegisterResources () returned 0x0 [0216.519] RmGetList () returned 0x0 [0218.185] RmShutdown () returned 0x0 [0218.826] RmEndSession () returned 0x0 [0218.828] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261948) returned 1 [0218.828] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0218.828] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml", dwFileAttributes=0x20) returned 0 [0218.828] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.828] CryptDestroyKey (hKey=0x5261948) returned 1 [0218.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd3a0 | out: hHeap=0x310000) returned 1 [0218.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb468 | out: hHeap=0x310000) returned 1 [0218.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5d30 | out: hHeap=0x310000) returned 1 [0218.828] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0218.828] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0218.829] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.829] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0218.832] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.832] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0218.832] CloseHandle (hObject=0x55c) returned 1 [0218.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bcfe8 [0218.832] RmStartSession () returned 0x0 [0218.833] RmRegisterResources () returned 0x0 [0218.834] RmGetList () returned 0x0 [0219.571] RmShutdown () returned 0x0 [0219.997] RmEndSession () returned 0x0 [0220.018] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261948) returned 1 [0220.018] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0220.018] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml", dwFileAttributes=0x20) returned 0 [0220.018] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.018] CryptDestroyKey (hKey=0x5261948) returned 1 [0220.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bcfe8 | out: hHeap=0x310000) returned 1 [0220.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0220.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14830 | out: hHeap=0x310000) returned 1 [0220.018] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0220.018] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0220.019] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.019] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0220.213] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.213] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0220.213] CloseHandle (hObject=0x55c) returned 1 [0220.213] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0220.214] RmStartSession () returned 0x0 [0220.217] RmRegisterResources () returned 0x0 [0220.222] RmGetList () returned 0x0 [0222.228] RmShutdown () returned 0x0 [0225.053] RmEndSession () returned 0x0 [0225.610] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261988) returned 1 [0225.610] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0225.610] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", dwFileAttributes=0x20) returned 0 [0225.610] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.610] CryptDestroyKey (hKey=0x5261988) returned 1 [0225.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0225.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3715a8 | out: hHeap=0x310000) returned 1 [0225.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14970 | out: hHeap=0x310000) returned 1 [0225.610] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0225.611] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0225.612] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.612] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0225.614] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.614] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0225.614] CloseHandle (hObject=0x5d4) returned 1 [0225.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0225.614] RmStartSession () returned 0x0 [0226.007] RmRegisterResources () returned 0x0 [0226.007] RmGetList () returned 0x0 [0227.130] RmShutdown () returned 0x0 [0229.407] RmEndSession () returned 0x0 [0229.408] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260f08) returned 1 [0229.408] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0229.408] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm", dwFileAttributes=0x20) returned 0 [0229.408] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.408] CryptDestroyKey (hKey=0x5260f08) returned 1 [0229.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0229.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c0b8 | out: hHeap=0x310000) returned 1 [0229.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14150 | out: hHeap=0x310000) returned 1 [0229.408] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0229.408] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0229.409] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.409] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0229.440] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.440] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0229.440] CloseHandle (hObject=0x694) returned 1 [0229.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0229.440] RmStartSession () returned 0x0 [0229.442] RmRegisterResources () returned 0x0 [0229.445] RmGetList () returned 0x0 [0229.668] RmShutdown () returned 0x0 [0231.686] RmEndSession () returned 0x0 [0232.107] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260b88) returned 1 [0232.107] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0232.107] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb", dwFileAttributes=0x20) returned 1 [0232.108] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0232.108] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0232.108] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=22680) returned 1 [0232.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x548edd0 [0232.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5627020 [0232.126] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0232.126] ReadFile (in: hFile=0x694, lpBuffer=0x5627040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x5627040*, lpNumberOfBytesRead=0x32afa64*=0x5898, lpOverlapped=0x0) returned 1 [0232.154] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0232.154] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0232.154] WriteFile (in: hFile=0x694, lpBuffer=0x548ede0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x548ede0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0232.154] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0232.154] WriteFile (in: hFile=0x694, lpBuffer=0x548ede0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x548ede0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0232.155] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x548ede0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0232.155] WriteFile (in: hFile=0x694, lpBuffer=0x548ede0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x548ede0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0232.155] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0232.155] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0232.155] WriteFile (in: hFile=0x694, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0232.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5627020 | out: hHeap=0x310000) returned 1 [0232.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x548edd0 | out: hHeap=0x310000) returned 1 [0232.160] CloseHandle (hObject=0x694) returned 1 [0232.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0232.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0232.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0232.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0232.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0232.612] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.bdcddcbaad"), dwFlags=0x1) returned 1 [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d197e0 [0232.614] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0232.614] GetLastError () returned 0x0 [0232.614] SetLastError (dwErrCode=0x0) [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0232.614] GetLastError () returned 0x0 [0232.614] SetLastError (dwErrCode=0x0) [0232.614] GetLastError () returned 0x0 [0232.614] SetLastError (dwErrCode=0x0) [0232.614] GetLastError () returned 0x0 [0232.614] SetLastError (dwErrCode=0x0) [0232.614] GetLastError () returned 0x0 [0232.614] SetLastError (dwErrCode=0x0) [0232.614] GetLastError () returned 0x0 [0232.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0232.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", cchWideChar=31, lpMultiByteStr=0x38c548, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", lpUsedDefaultChar=0x0) returned 31 [0232.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5300000 | out: hHeap=0x310000) returned 1 [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0232.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0232.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0232.615] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0232.615] WriteFile (in: hFile=0x694, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x32af9d8*=0xe72, lpOverlapped=0x0) returned 1 [0232.616] CloseHandle (hObject=0x694) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0232.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0232.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0232.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0232.617] CryptDestroyKey (hKey=0x5260b88) returned 1 [0232.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0232.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55715a8 | out: hHeap=0x310000) returned 1 [0232.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14ba0 | out: hHeap=0x310000) returned 1 [0232.617] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0232.617] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0232.617] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.617] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0232.618] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.618] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0232.618] CloseHandle (hObject=0x694) returned 1 [0232.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0232.619] RmStartSession () returned 0x0 [0233.002] RmRegisterResources () returned 0x0 [0233.002] RmGetList () returned 0x0 [0233.126] RmShutdown () returned 0x0 [0233.811] RmEndSession () returned 0x0 [0233.921] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260b88) returned 1 [0233.921] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0233.921] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", dwFileAttributes=0x20) returned 0 [0233.921] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.921] CryptDestroyKey (hKey=0x5260b88) returned 1 [0233.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0233.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55716d8 | out: hHeap=0x310000) returned 1 [0233.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572b58 | out: hHeap=0x310000) returned 1 [0233.922] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0233.922] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0233.922] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.922] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0233.998] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.998] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0233.998] CloseHandle (hObject=0x49c) returned 1 [0233.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0233.998] RmStartSession () returned 0x0 [0234.001] RmRegisterResources () returned 0x0 [0234.001] RmGetList () returned 0x0 [0235.796] RmShutdown () returned 0x0 [0238.910] RmEndSession () returned 0x0 [0238.910] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261488) returned 1 [0238.910] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0238.911] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", dwFileAttributes=0x20) returned 0 [0238.911] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.911] CryptDestroyKey (hKey=0x5261488) returned 1 [0238.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0238.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0238.911] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572c98 | out: hHeap=0x310000) returned 1 [0238.911] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0238.911] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0238.911] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.911] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0238.921] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.921] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0238.921] CloseHandle (hObject=0x49c) returned 1 [0238.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0238.921] RmStartSession () returned 0x0 [0238.923] RmRegisterResources () returned 0x0 [0238.923] RmGetList () returned 0x0 [0239.486] RmShutdown () returned 0x0 [0241.528] RmEndSession () returned 0x0 [0241.529] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261908) returned 1 [0241.529] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0241.529] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties", dwFileAttributes=0x20) returned 1 [0241.529] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0241.529] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0241.530] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=3285) returned 1 [0241.530] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0241.530] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79a9020 [0241.731] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0241.731] ReadFile (in: hFile=0x49c, lpBuffer=0x79a9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x79a9040*, lpNumberOfBytesRead=0x32afa64*=0xcd5, lpOverlapped=0x0) returned 1 [0241.733] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0241.733] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0241.733] WriteFile (in: hFile=0x49c, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0241.733] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0241.733] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0241.733] WriteFile (in: hFile=0x49c, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0241.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79a9020 | out: hHeap=0x310000) returned 1 [0241.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0241.788] CloseHandle (hObject=0x49c) returned 1 [0241.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0241.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbb98 [0241.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0241.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc718 [0241.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0241.789] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0241.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0241.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392128 [0241.789] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0241.789] GetLastError () returned 0x0 [0241.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0241.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x32af8a0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0241.790] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0241.790] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0241.790] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0241.791] WriteFile (in: hFile=0x49c, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x32af9d8*=0xe54, lpOverlapped=0x0) returned 1 [0241.792] CloseHandle (hObject=0x49c) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc718 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0241.792] CryptDestroyKey (hKey=0x5261908) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee5e8 | out: hHeap=0x310000) returned 1 [0241.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572658 | out: hHeap=0x310000) returned 1 [0241.792] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0241.792] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0241.792] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.792] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0241.822] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.822] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0241.822] CloseHandle (hObject=0x49c) returned 1 [0241.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0241.822] RmStartSession () returned 0x0 [0242.357] RmRegisterResources () returned 0x0 [0242.361] RmGetList () returned 0x0 [0242.571] RmShutdown () returned 0x0 [0243.884] RmEndSession () returned 0x0 [0243.885] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52618c8) returned 1 [0243.885] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0243.885] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar", dwFileAttributes=0x20) returned 1 [0243.885] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0243.885] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0243.885] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=3860502) returned 1 [0243.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0243.886] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76fc020 [0244.129] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0244.129] ReadFile (in: hFile=0x4d4, lpBuffer=0x76fc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x76fc040*, lpNumberOfBytesRead=0x32afa64*=0x100000, lpOverlapped=0x0) returned 1 [0244.138] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0244.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.156] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.156] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.156] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.156] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.156] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.236] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.630] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.630] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.630] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.630] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.630] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.631] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.631] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.631] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.631] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.631] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.631] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.631] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.631] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.631] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.631] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.632] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.632] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.632] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.632] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.632] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.632] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.632] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.632] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.632] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.632] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.633] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.633] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.633] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.633] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.633] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.633] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.634] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.634] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.634] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.634] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.634] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.634] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.634] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.634] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.634] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.634] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.635] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.635] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.635] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.635] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.635] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.635] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0244.635] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0244.635] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0244.635] ReadFile (in: hFile=0x4d4, lpBuffer=0x76fc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x76fc040*, lpNumberOfBytesRead=0x32afa64*=0x100000, lpOverlapped=0x0) returned 1 [0245.137] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0245.137] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.137] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.138] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.138] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.139] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.139] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.140] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.140] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.141] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.142] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.142] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.143] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.144] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.144] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.145] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.145] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.146] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.146] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.147] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.147] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.148] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.148] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.149] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.149] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.150] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.150] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.151] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.151] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.152] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.152] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.153] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.153] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.154] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.154] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.155] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0245.155] ReadFile (in: hFile=0x4d4, lpBuffer=0x76fc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x76fc040*, lpNumberOfBytesRead=0x32afa64*=0x100000, lpOverlapped=0x0) returned 1 [0245.924] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0245.924] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.925] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.926] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.927] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.927] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.928] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.928] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.929] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.929] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.930] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.930] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.931] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.932] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.932] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.933] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.934] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.935] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.936] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.937] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.937] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.938] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.938] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.939] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.939] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.940] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.940] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.941] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.941] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.941] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.941] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0245.941] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0245.941] WriteFile (in: hFile=0x4d4, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0247.483] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0247.483] GetLastError () returned 0x0 [0247.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0247.483] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0247.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0247.483] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b848 | out: hHeap=0x310000) returned 1 [0247.483] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0247.483] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0247.483] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0247.483] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0247.484] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x32af9d8*=0xe63, lpOverlapped=0x0) returned 1 [0247.485] CloseHandle (hObject=0x4d4) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0247.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0247.486] CryptDestroyKey (hKey=0x52618c8) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a36f8 | out: hHeap=0x310000) returned 1 [0247.486] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352600 | out: hHeap=0x310000) returned 1 [0247.486] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0247.486] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0247.486] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.486] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0247.487] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.487] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0247.487] CloseHandle (hObject=0x4d4) returned 1 [0247.487] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0247.487] RmStartSession () returned 0x0 [0247.488] RmRegisterResources () returned 0x0 [0247.489] RmGetList () returned 0x0 [0247.513] RmShutdown () [0249.133] RmEndSession () returned 0x0 [0249.368] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261a88) returned 1 [0249.368] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0249.368] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0249.369] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0249.369] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0249.369] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=168) returned 1 [0249.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0249.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3c020 [0249.436] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0249.436] GetLastError () returned 0x0 [0249.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0249.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0249.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0249.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0249.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0249.436] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0249.437] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x32af9d8*=0xe69, lpOverlapped=0x0) returned 1 [0249.438] CloseHandle (hObject=0x4d4) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f97a8 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0249.438] CryptDestroyKey (hKey=0x5261a88) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efae8 | out: hHeap=0x310000) returned 1 [0249.438] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53531e0 | out: hHeap=0x310000) returned 1 [0249.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0249.439] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0249.439] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.439] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0249.506] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.506] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0249.506] CloseHandle (hObject=0x4d4) returned 1 [0249.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0249.506] RmStartSession () returned 0x0 [0249.508] RmRegisterResources () returned 0x0 [0249.508] RmGetList () returned 0x0 [0250.762] RmShutdown () returned 0x0 [0251.328] RmEndSession () returned 0x0 [0251.329] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52612c8) returned 1 [0251.329] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0251.329] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", dwFileAttributes=0x20) returned 1 [0251.329] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0251.330] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0251.330] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=33932) returned 1 [0251.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54cfe68 [0251.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b7020 [0251.348] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0251.348] ReadFile (in: hFile=0x4d4, lpBuffer=0x64b7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x64b7040*, lpNumberOfBytesRead=0x32afa64*=0x848c, lpOverlapped=0x0) returned 1 [0251.382] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0251.382] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0251.382] WriteFile (in: hFile=0x4d4, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0251.383] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0251.383] WriteFile (in: hFile=0x4d4, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0251.383] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0251.383] WriteFile (in: hFile=0x4d4, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0251.383] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0251.383] WriteFile (in: hFile=0x4d4, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0251.383] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0251.383] WriteFile (in: hFile=0x4d4, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0251.383] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0251.383] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0251.384] WriteFile (in: hFile=0x4d4, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0251.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b7020 | out: hHeap=0x310000) returned 1 [0251.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54cfe68 | out: hHeap=0x310000) returned 1 [0251.389] CloseHandle (hObject=0x4d4) returned 1 [0251.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0251.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0251.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19df8 [0251.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0251.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0251.389] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a050 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0251.390] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0251.390] GetLastError () returned 0x0 [0251.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0251.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c548, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.390] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f29c0 | out: hHeap=0x310000) returned 1 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0251.390] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0251.390] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0251.391] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x32af9d8*=0xe70, lpOverlapped=0x0) returned 1 [0251.392] CloseHandle (hObject=0x4d4) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a050 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19df8 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0251.392] CryptDestroyKey (hKey=0x52612c8) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a408 | out: hHeap=0x310000) returned 1 [0251.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353410 | out: hHeap=0x310000) returned 1 [0251.392] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0251.392] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0251.393] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.393] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0252.020] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.020] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0252.020] CloseHandle (hObject=0x4d4) returned 1 [0252.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a488 [0252.020] RmStartSession () returned 0x0 [0252.137] RmRegisterResources () returned 0x0 [0252.137] RmGetList () returned 0x0 [0252.354] RmShutdown () returned 0x0 [0252.763] RmEndSession () returned 0x0 [0252.764] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261a08) returned 1 [0252.764] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0252.764] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", dwFileAttributes=0x20) returned 1 [0252.764] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0252.765] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0252.765] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=2126) returned 1 [0252.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0252.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cc020 [0252.783] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0252.783] ReadFile (in: hFile=0x4f0, lpBuffer=0x65cc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x65cc040*, lpNumberOfBytesRead=0x32afa64*=0x84e, lpOverlapped=0x0) returned 1 [0252.785] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0252.785] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0252.785] WriteFile (in: hFile=0x4f0, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0252.785] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0252.785] WriteFile (in: hFile=0x4f0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0252.786] WriteFile (in: hFile=0x4f0, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0252.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65cc020 | out: hHeap=0x310000) returned 1 [0252.790] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d6a020 | out: hHeap=0x310000) returned 1 [0252.790] CloseHandle (hObject=0x4f0) returned 1 [0252.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0252.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0252.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0252.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0252.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0252.791] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.bdcddcbaad"), dwFlags=0x1) returned 1 [0252.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19df8 [0252.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0252.792] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0252.792] GetLastError () returned 0x0 [0252.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0252.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x32af8a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0252.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0252.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0252.792] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0252.793] WriteFile (in: hFile=0x4f0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x32af9d8*=0xe57, lpOverlapped=0x0) returned 1 [0252.794] CloseHandle (hObject=0x4f0) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19df8 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0252.794] CryptDestroyKey (hKey=0x5261a08) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c395f8 | out: hHeap=0x310000) returned 1 [0252.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353000 | out: hHeap=0x310000) returned 1 [0252.794] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0252.794] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0252.794] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.795] ReadFile (in: hFile=0x4f0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0252.914] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.914] ReadFile (in: hFile=0x4f0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0252.914] CloseHandle (hObject=0x4f0) returned 1 [0252.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0252.915] RmStartSession () returned 0x0 [0253.005] RmRegisterResources () returned 0x0 [0253.005] RmGetList () returned 0x0 [0253.047] RmShutdown () returned 0x0 [0255.555] RmEndSession () returned 0x0 [0255.556] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261888) returned 1 [0255.556] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0255.556] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy", dwFileAttributes=0x20) returned 1 [0255.556] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0255.556] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0255.556] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=2466) returned 1 [0255.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0255.557] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6211020 [0255.906] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0255.906] ReadFile (in: hFile=0x550, lpBuffer=0x6211040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6211040*, lpNumberOfBytesRead=0x32afa64*=0x9a2, lpOverlapped=0x0) returned 1 [0255.907] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0255.907] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d60020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d60020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0255.907] WriteFile (in: hFile=0x550, lpBuffer=0x5d60020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5d60020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0255.908] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0255.908] WriteFile (in: hFile=0x550, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0255.908] WriteFile (in: hFile=0x550, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0255.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6211020 | out: hHeap=0x310000) returned 1 [0256.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d60010 | out: hHeap=0x310000) returned 1 [0256.103] CloseHandle (hObject=0x550) returned 1 [0256.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0256.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0256.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0256.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0256.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0256.103] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.bdcddcbaad"), dwFlags=0x1) returned 1 [0256.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0256.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0256.104] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0256.104] GetLastError () returned 0x0 [0256.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x32af8a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uZdPMPqLr8IS7", lpUsedDefaultChar=0x0) returned 13 [0256.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0256.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0256.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0256.104] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0256.105] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0256.105] WriteFile (in: hFile=0x550, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x32af9d8*=0xe60, lpOverlapped=0x0) returned 1 [0256.106] CloseHandle (hObject=0x550) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0256.110] CryptDestroyKey (hKey=0x5261888) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3890 | out: hHeap=0x310000) returned 1 [0256.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53530f0 | out: hHeap=0x310000) returned 1 [0256.110] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0256.110] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0256.110] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.110] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0256.113] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.113] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0256.113] CloseHandle (hObject=0x550) returned 1 [0256.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d08 [0256.113] RmStartSession () returned 0x0 [0256.605] RmRegisterResources () returned 0x0 [0256.605] RmGetList () returned 0x0 [0256.629] RmShutdown () returned 0x0 [0258.568] RmEndSession () returned 0x0 [0258.568] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260d88) returned 1 [0258.569] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0258.569] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", dwFileAttributes=0x20) returned 1 [0258.569] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0258.569] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0258.569] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=955) returned 1 [0258.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0258.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7af4020 [0259.337] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0259.337] GetLastError () returned 0x0 [0259.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TRxzM0DGsyQfi7UmuqCoF1I", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0259.337] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0259.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TRxzM0DGsyQfi7UmuqCoF1I", cchWideChar=23, lpMultiByteStr=0x38c160, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TRxzM0DGsyQfi7UmuqCoF1I", lpUsedDefaultChar=0x0) returned 23 [0259.337] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b538 | out: hHeap=0x310000) returned 1 [0259.337] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0259.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0259.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0259.338] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0259.339] WriteFile (in: hFile=0x508, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x32af9d8*=0xe6a, lpOverlapped=0x0) returned 1 [0259.339] CloseHandle (hObject=0x508) returned 1 [0259.339] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0259.339] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0259.339] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0259.339] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3992f8 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0259.340] CryptDestroyKey (hKey=0x5260d88) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d08 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39aa8 | out: hHeap=0x310000) returned 1 [0259.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351d40 | out: hHeap=0x310000) returned 1 [0259.340] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0259.340] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0259.340] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.340] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0259.351] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.351] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0259.352] CloseHandle (hObject=0x508) returned 1 [0259.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b620 [0259.352] RmStartSession () returned 0x0 [0259.353] RmRegisterResources () returned 0x0 [0259.354] RmGetList () returned 0x0 [0259.396] RmShutdown () returned 0x0 [0261.588] RmEndSession () returned 0x0 [0261.655] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261088) returned 1 [0261.655] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0261.655] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0261.655] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0261.655] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0261.655] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=1124942) returned 1 [0261.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5b11288 [0261.656] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c27020 [0262.798] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0262.798] GetLastError () returned 0x0 [0262.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0262.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x32af8a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0262.798] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0262.798] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0262.798] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0262.799] WriteFile (in: hFile=0x508, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x32af9d8*=0xe57, lpOverlapped=0x0) returned 1 [0262.800] CloseHandle (hObject=0x508) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04220 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a07a0 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04de8 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0262.800] CryptDestroyKey (hKey=0x5261088) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b620 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9630 | out: hHeap=0x310000) returned 1 [0262.800] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351ac0 | out: hHeap=0x310000) returned 1 [0262.800] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0262.800] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0262.801] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.801] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0262.809] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.809] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0262.809] CloseHandle (hObject=0x508) returned 1 [0262.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b620 [0262.809] RmStartSession () returned 0x0 [0263.757] RmRegisterResources () returned 0x0 [0263.758] RmGetList () returned 0x0 [0263.782] RmShutdown () returned 0x0 [0264.801] RmEndSession () returned 0x0 [0264.802] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260b48) returned 1 [0264.802] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0264.802] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.802] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0264.802] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0264.803] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=1261) returned 1 [0264.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0264.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x573e020 [0266.606] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0266.606] GetLastError () returned 0x0 [0266.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x32af8a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.606] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0266.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0266.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0266.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0266.606] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.607] WriteFile (in: hFile=0x680, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x32af9d8*=0xe61, lpOverlapped=0x0) returned 1 [0266.608] CloseHandle (hObject=0x680) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5678 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ba0cc8 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5848 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0266.608] CryptDestroyKey (hKey=0x5260b48) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b620 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348608 | out: hHeap=0x310000) returned 1 [0266.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19740 | out: hHeap=0x310000) returned 1 [0266.608] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0266.608] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.609] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.609] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0266.610] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.610] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0266.610] CloseHandle (hObject=0x680) returned 1 [0266.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0266.610] RmStartSession () returned 0x0 [0266.830] RmRegisterResources () returned 0x0 [0266.830] RmGetList () returned 0x0 [0267.035] RmShutdown () returned 0x0 [0268.235] RmEndSession () returned 0x0 [0268.236] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52618c8) returned 1 [0268.236] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0268.236] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF", dwFileAttributes=0x220) returned 1 [0268.236] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0268.236] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0268.236] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=7216) returned 1 [0268.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0268.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79fb020 [0269.082] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0269.082] GetLastError () returned 0x0 [0269.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0269.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0269.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x38c390, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1f15BUaqm7XqtONc8btxaBe3", lpUsedDefaultChar=0x0) returned 24 [0269.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e88f60 | out: hHeap=0x310000) returned 1 [0269.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0269.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0269.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0269.083] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0269.084] WriteFile (in: hFile=0x450, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x32af9d8*=0xe6b, lpOverlapped=0x0) returned 1 [0269.084] CloseHandle (hObject=0x450) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbfe8 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0269.085] CryptDestroyKey (hKey=0x52618c8) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570210 | out: hHeap=0x310000) returned 1 [0269.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0269.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0269.085] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0269.086] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.086] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0269.127] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.127] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0269.127] CloseHandle (hObject=0x610) returned 1 [0269.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0269.127] RmStartSession () returned 0x0 [0269.129] RmRegisterResources () returned 0x0 [0269.133] RmGetList () returned 0x0 [0269.185] RmShutdown () returned 0x0 [0270.090] RmEndSession () returned 0x0 [0270.091] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261548) returned 1 [0270.091] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0270.091] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF", dwFileAttributes=0x220) returned 1 [0270.091] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0270.091] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0270.091] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=5253) returned 1 [0270.091] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0270.091] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6218020 [0271.125] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0271.126] ReadFile (in: hFile=0x610, lpBuffer=0x6218040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x6218040*, lpNumberOfBytesRead=0x32afa64*=0x1485, lpOverlapped=0x0) returned 1 [0271.143] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0271.143] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0271.143] WriteFile (in: hFile=0x610, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0271.143] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0271.144] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0271.144] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0271.144] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6218020 | out: hHeap=0x310000) returned 1 [0271.149] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0271.149] CloseHandle (hObject=0x610) returned 1 [0271.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0271.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbf30 [0271.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0271.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc438 [0271.149] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0271.149] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0271.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0271.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0271.150] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0271.150] GetLastError () returned 0x0 [0271.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0271.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0271.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", cchWideChar=30, lpMultiByteStr=0x38c390, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", lpUsedDefaultChar=0x0) returned 30 [0271.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e900d0 | out: hHeap=0x310000) returned 1 [0271.151] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0271.151] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eb8d0 [0271.151] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0271.151] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0271.151] WriteFile (in: hFile=0x610, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x32af9d8*=0xe71, lpOverlapped=0x0) returned 1 [0271.152] CloseHandle (hObject=0x610) returned 1 [0271.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0271.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0271.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc438 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0271.153] CryptDestroyKey (hKey=0x5261548) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5b58 | out: hHeap=0x310000) returned 1 [0271.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e34a0 | out: hHeap=0x310000) returned 1 [0271.153] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0271.153] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0271.153] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.153] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0271.155] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.155] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0271.155] CloseHandle (hObject=0x610) returned 1 [0271.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0271.155] RmStartSession () returned 0x0 [0271.156] RmRegisterResources () returned 0x0 [0271.160] RmGetList () returned 0x0 [0272.174] RmShutdown () returned 0x0 [0274.574] RmEndSession () returned 0x0 [0274.575] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52613c8) returned 1 [0274.575] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0274.575] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF", dwFileAttributes=0x220) returned 1 [0274.575] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0274.575] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0274.575] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=4894) returned 1 [0274.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0274.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d4020 [0275.095] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0275.095] GetLastError () returned 0x0 [0275.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x32af8a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.095] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0275.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0275.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.096] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0275.096] WriteFile (in: hFile=0x610, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x32af9d8*=0xe5e, lpOverlapped=0x0) returned 1 [0275.097] CloseHandle (hObject=0x610) returned 1 [0275.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0275.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0275.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cee060 | out: hHeap=0x310000) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0275.098] CryptDestroyKey (hKey=0x52613c8) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0275.098] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3680 | out: hHeap=0x310000) returned 1 [0275.098] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0275.098] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0275.098] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.098] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0275.108] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.108] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0275.108] CloseHandle (hObject=0x610) returned 1 [0275.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0275.108] RmStartSession () returned 0x0 [0275.112] RmRegisterResources () returned 0x0 [0275.112] RmGetList () returned 0x0 [0275.447] RmShutdown () returned 0x0 [0275.724] RmEndSession () returned 0x0 [0275.725] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260f08) returned 1 [0275.725] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0275.725] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF", dwFileAttributes=0x220) returned 1 [0275.725] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0275.725] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0275.726] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=1596) returned 1 [0275.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0275.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6217020 [0276.681] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0276.681] GetLastError () returned 0x0 [0276.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WWGb0ObVfQVKUNp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0276.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WWGb0ObVfQVKUNp", cchWideChar=15, lpMultiByteStr=0x32af8a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WWGb0ObVfQVKUNp", lpUsedDefaultChar=0x0) returned 15 [0276.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0276.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0276.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0276.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0276.682] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0276.683] WriteFile (in: hFile=0x610, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x32af9d8*=0xe62, lpOverlapped=0x0) returned 1 [0276.684] CloseHandle (hObject=0x610) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4988 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a53a0 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0276.684] CryptDestroyKey (hKey=0x5260f08) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6738 | out: hHeap=0x310000) returned 1 [0276.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3720 | out: hHeap=0x310000) returned 1 [0276.684] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0276.684] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0276.684] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.685] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0276.689] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0276.689] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0276.689] CloseHandle (hObject=0x610) returned 1 [0276.689] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0276.689] RmStartSession () returned 0x0 [0276.693] RmRegisterResources () returned 0x0 [0276.693] RmGetList () returned 0x0 [0277.531] RmShutdown () returned 0x0 [0278.990] RmEndSession () returned 0x0 [0278.991] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261088) returned 1 [0278.991] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0278.991] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF", dwFileAttributes=0x220) returned 1 [0278.991] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0278.992] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0278.992] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=5836) returned 1 [0278.992] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0278.992] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bc020 [0279.010] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0279.726] ReadFile (in: hFile=0x610, lpBuffer=0x64bc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x64bc040*, lpNumberOfBytesRead=0x32afa64*=0x16cc, lpOverlapped=0x0) returned 1 [0279.729] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0279.729] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0279.729] WriteFile (in: hFile=0x610, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0279.729] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0279.729] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0279.730] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0279.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64bc020 | out: hHeap=0x310000) returned 1 [0280.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0280.057] CloseHandle (hObject=0x610) returned 1 [0280.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0280.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0280.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.058] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0280.059] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0280.059] GetLastError () returned 0x0 [0280.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0280.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c1b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.059] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7d980 | out: hHeap=0x310000) returned 1 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0280.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.059] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0280.060] WriteFile (in: hFile=0x610, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x32af9d8*=0xe6f, lpOverlapped=0x0) returned 1 [0280.061] CloseHandle (hObject=0x610) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.061] CryptDestroyKey (hKey=0x5261088) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a66a0 | out: hHeap=0x310000) returned 1 [0280.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1970 | out: hHeap=0x310000) returned 1 [0280.061] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0280.061] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0280.061] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.061] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0280.079] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.080] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0280.080] CloseHandle (hObject=0x610) returned 1 [0280.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0280.080] RmStartSession () returned 0x0 [0280.081] RmRegisterResources () returned 0x0 [0280.082] RmGetList () returned 0x0 [0280.122] RmShutdown () returned 0x0 [0280.543] RmEndSession () returned 0x0 [0280.602] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5260c48) returned 1 [0280.602] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0280.602] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF", dwFileAttributes=0x220) returned 1 [0280.602] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0280.602] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0280.602] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=2492) returned 1 [0280.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0280.603] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf5020 [0280.621] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0280.621] ReadFile (in: hFile=0x610, lpBuffer=0x4cf5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x4cf5040*, lpNumberOfBytesRead=0x32afa64*=0x9bc, lpOverlapped=0x0) returned 1 [0280.621] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0280.621] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0280.621] WriteFile (in: hFile=0x610, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0280.622] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0280.622] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0280.622] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0280.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf5020 | out: hHeap=0x310000) returned 1 [0280.627] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0280.627] CloseHandle (hObject=0x610) returned 1 [0280.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0280.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0280.627] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.627] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0280.628] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0280.628] GetLastError () returned 0x0 [0280.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0280.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c548, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.628] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7ff50 | out: hHeap=0x310000) returned 1 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0280.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.628] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0280.629] WriteFile (in: hFile=0x610, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x32af9d8*=0xe6f, lpOverlapped=0x0) returned 1 [0280.630] CloseHandle (hObject=0x610) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.630] CryptDestroyKey (hKey=0x5260c48) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94638 | out: hHeap=0x310000) returned 1 [0280.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1d80 | out: hHeap=0x310000) returned 1 [0280.630] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0280.631] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0280.631] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.631] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0280.651] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.651] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0280.651] CloseHandle (hObject=0x610) returned 1 [0280.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0280.651] RmStartSession () returned 0x0 [0280.653] RmRegisterResources () returned 0x0 [0280.654] RmGetList () returned 0x0 [0281.365] RmShutdown () returned 0x0 [0284.261] RmEndSession () returned 0x0 [0284.262] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x5261508) returned 1 [0284.262] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0284.262] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF", dwFileAttributes=0x220) returned 1 [0284.262] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0284.262] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0284.262] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=4808) returned 1 [0284.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0284.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f5020 [0285.039] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0285.039] ReadFile (in: hFile=0x610, lpBuffer=0x76f5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x76f5040*, lpNumberOfBytesRead=0x32afa64*=0x12c8, lpOverlapped=0x0) returned 1 [0285.041] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0285.041] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0285.041] WriteFile (in: hFile=0x610, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0285.041] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0285.041] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0285.041] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0285.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f5020 | out: hHeap=0x310000) returned 1 [0286.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0286.394] CloseHandle (hObject=0x610) returned 1 [0286.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0286.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0286.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4560 [0286.394] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2490 [0286.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0286.394] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0286.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a47c0 [0286.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0286.395] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0286.395] GetLastError () returned 0x0 [0286.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0286.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x32af8a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aGphKsS54ZcVf9i", lpUsedDefaultChar=0x0) returned 15 [0286.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0286.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0286.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0286.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157af8 [0286.396] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0286.397] WriteFile (in: hFile=0x610, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x32af9d8*=0xe62, lpOverlapped=0x0) returned 1 [0286.397] CloseHandle (hObject=0x610) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157af8 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a47c0 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2490 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4560 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0286.398] CryptDestroyKey (hKey=0x5261508) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c943d8 | out: hHeap=0x310000) returned 1 [0286.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e21e0 | out: hHeap=0x310000) returned 1 [0286.398] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0286.398] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0286.398] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.398] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0286.410] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.410] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0286.410] CloseHandle (hObject=0x610) returned 1 [0286.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0286.411] RmStartSession () returned 0x0 [0286.412] RmRegisterResources () returned 0x0 [0286.416] RmGetList () returned 0x0 [0287.700] RmShutdown () returned 0x0 [0288.069] RmEndSession () returned 0x0 [0288.069] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52618c8) returned 1 [0288.069] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0288.070] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF", dwFileAttributes=0x220) returned 1 [0288.070] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0288.070] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0288.070] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=20189) returned 1 [0288.070] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4ba7380 [0288.070] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65dd020 [0288.362] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0288.362] ReadFile (in: hFile=0x610, lpBuffer=0x65dd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x65dd040*, lpNumberOfBytesRead=0x32afa64*=0x4edd, lpOverlapped=0x0) returned 1 [0288.364] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0288.364] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0288.364] WriteFile (in: hFile=0x610, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0288.365] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0288.365] WriteFile (in: hFile=0x610, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0288.365] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0288.365] WriteFile (in: hFile=0x610, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0288.365] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0288.365] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0288.365] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0288.365] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65dd020 | out: hHeap=0x310000) returned 1 [0288.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba7380 | out: hHeap=0x310000) returned 1 [0288.642] CloseHandle (hObject=0x610) returned 1 [0288.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0288.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3fe0 [0288.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6148 [0288.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c44e8 [0288.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3fe0 | out: hHeap=0x310000) returned 1 [0288.643] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6608 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb0b0 [0288.644] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0288.644] GetLastError () returned 0x0 [0288.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0288.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x38c0c0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n02uzHYCkn2cuVUIt7q96r", lpUsedDefaultChar=0x0) returned 22 [0288.644] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0288.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0288.645] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0288.645] WriteFile (in: hFile=0x610, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x32af9d8*=0xe69, lpOverlapped=0x0) returned 1 [0288.646] CloseHandle (hObject=0x610) returned 1 [0288.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0288.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0288.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb0b0 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6608 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c44e8 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6148 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0288.647] CryptDestroyKey (hKey=0x52618c8) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0288.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2910 | out: hHeap=0x310000) returned 1 [0288.647] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0288.647] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0288.647] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.647] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0288.657] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.657] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0288.657] CloseHandle (hObject=0x610) returned 1 [0288.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6278 [0288.657] RmStartSession () returned 0x0 [0288.658] RmRegisterResources () returned 0x0 [0288.659] RmGetList () returned 0x0 [0289.189] RmShutdown () returned 0x0 [0291.886] RmEndSession () returned 0x0 [0291.887] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x35d948) returned 1 [0291.887] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0291.887] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF", dwFileAttributes=0x220) returned 1 [0291.887] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0291.887] CryptEncrypt (in: hKey=0x35d948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0291.887] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=11058) returned 1 [0291.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0291.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e9020 [0292.333] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0292.333] ReadFile (in: hFile=0x610, lpBuffer=0x49e9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x49e9040*, lpNumberOfBytesRead=0x32afa64*=0x2b32, lpOverlapped=0x0) returned 1 [0292.334] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0292.334] CryptEncrypt (in: hKey=0x35d948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0292.335] WriteFile (in: hFile=0x610, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0292.335] CryptEncrypt (in: hKey=0x35d948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0292.335] WriteFile (in: hFile=0x610, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0292.335] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0292.335] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0292.335] WriteFile (in: hFile=0x610, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0292.335] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e9020 | out: hHeap=0x310000) returned 1 [0292.443] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b47008 | out: hHeap=0x310000) returned 1 [0292.443] CloseHandle (hObject=0x610) returned 1 [0292.444] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0292.444] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0292.444] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0292.444] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0292.444] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0292.444] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5b58 [0292.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0292.445] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0292.445] GetLastError () returned 0x0 [0292.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x32af8a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0292.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.446] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0292.446] WriteFile (in: hFile=0x610, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x32af9d8*=0xe56, lpOverlapped=0x0) returned 1 [0292.447] CloseHandle (hObject=0x610) returned 1 [0292.447] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.447] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0292.447] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5b58 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0292.448] CryptDestroyKey (hKey=0x35d948) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6278 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95f28 | out: hHeap=0x310000) returned 1 [0292.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e25f0 | out: hHeap=0x310000) returned 1 [0292.448] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0292.448] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0292.448] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.448] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0292.450] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.450] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0292.450] CloseHandle (hObject=0x610) returned 1 [0292.450] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6148 [0292.450] RmStartSession () returned 0x0 [0293.278] RmRegisterResources () returned 0x0 [0293.278] RmGetList () returned 0x0 [0293.433] RmShutdown () returned 0x0 [0295.259] RmEndSession () returned 0x0 [0295.260] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x32afb64 | out: phKey=0x32afb64*=0x52616c8) returned 1 [0295.260] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0295.260] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF", dwFileAttributes=0x220) returned 1 [0295.261] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0295.261] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x32af9c4*=0x2000) returned 1 [0295.261] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x32afa5c | out: lpFileSize=0x32afa5c*=2556) returned 1 [0295.261] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0295.261] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49eb020 [0295.279] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0295.279] ReadFile (in: hFile=0x450, lpBuffer=0x49eb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x49eb040*, lpNumberOfBytesRead=0x32afa64*=0x9fc, lpOverlapped=0x0) returned 1 [0295.279] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa4c | out: lpNewFilePointer=0x0) returned 1 [0295.280] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x32af9d8*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x32af9d8*=0x2000) returned 1 [0295.280] WriteFile (in: hFile=0x450, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x32afa68*=0x2000, lpOverlapped=0x0) returned 1 [0295.280] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afa54 | out: lpNewFilePointer=0x0) returned 1 [0295.280] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x32afa68*=0x200, lpOverlapped=0x0) returned 1 [0295.280] WriteFile (in: hFile=0x450, lpBuffer=0x32afa04*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x32afa68, lpOverlapped=0x0 | out: lpBuffer=0x32afa04*, lpNumberOfBytesWritten=0x32afa68*=0x18, lpOverlapped=0x0) returned 1 [0295.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49eb020 | out: hHeap=0x310000) returned 1 [0295.286] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0295.286] CloseHandle (hObject=0x450) returned 1 [0295.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0295.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf3b0 [0295.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c959d0 [0295.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c07d0 [0295.286] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x310000) returned 1 [0295.286] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0295.287] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95b98 [0295.287] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0295.287] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x32af838 | out: lpSystemTimeAsFileTime=0x32af838) [0295.287] GetLastError () returned 0x0 [0295.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0295.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x32af8a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrHQog3L8507y", lpUsedDefaultChar=0x0) returned 13 [0295.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0295.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0295.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0295.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0295.288] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0295.289] WriteFile (in: hFile=0x450, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x32af9d8, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x32af9d8*=0xe60, lpOverlapped=0x0) returned 1 [0295.289] CloseHandle (hObject=0x450) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b98 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c07d0 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0295.290] CryptDestroyKey (hKey=0x52616c8) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6148 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53067e0 | out: hHeap=0x310000) returned 1 [0295.290] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609bd8 | out: hHeap=0x310000) returned 1 [0295.290] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x32afb98, lpCompletionKey=0x32afb9c, lpOverlapped=0x32afb94) returned 1 [0295.290] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0295.290] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa68 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.290] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa64, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa64*=0x18, lpOverlapped=0x0) returned 1 [0296.174] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afa70 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.174] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32afa58, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x32afa58*=0x18, lpOverlapped=0x0) returned 1 [0296.174] CloseHandle (hObject=0x450) returned 1 [0296.174] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c958a0 [0296.174] RmStartSession () returned 0x0 [0296.177] RmRegisterResources () returned 0x0 [0296.177] RmGetList () returned 0x0 [0296.616] RmShutdown () returned 0x0 [0299.107] RmEndSession () Thread: id = 9 os_tid = 0x1094 [0068.587] GetLastError () returned 0x57 [0068.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x349d10 [0068.588] SetLastError (dwErrCode=0x57) [0068.588] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0111.933] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0113.029] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0115.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0116.140] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0117.156] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0118.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0122.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0126.620] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0129.881] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0130.914] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0134.189] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0134.404] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.404] ReadFile (in: hFile=0x510, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0134.405] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.405] ReadFile (in: hFile=0x510, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0134.405] CloseHandle (hObject=0x510) returned 1 [0134.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391838 [0134.406] RmStartSession () returned 0x0 [0134.412] RmRegisterResources () returned 0x0 [0134.428] RmGetList () returned 0x0 [0135.148] RmShutdown () returned 0x0 [0136.231] RmEndSession () returned 0x0 [0136.989] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261308) returned 1 [0136.990] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0136.990] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd", dwFileAttributes=0x20) returned 1 [0136.990] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0136.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0136.990] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=307) returned 1 [0136.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0136.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590d020 [0137.008] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0137.008] ReadFile (in: hFile=0x518, lpBuffer=0x590d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x590d040*, lpNumberOfBytesRead=0x33ef7d4*=0x133, lpOverlapped=0x0) returned 1 [0137.009] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0137.009] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0137.009] WriteFile (in: hFile=0x518, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0137.146] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0137.146] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0137.146] WriteFile (in: hFile=0x518, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0137.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590d020 | out: hHeap=0x310000) returned 1 [0138.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0138.891] CloseHandle (hObject=0x518) returned 1 [0138.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0138.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0138.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a28c0 [0138.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39afe0 [0138.893] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0138.893] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\\\$GetCurrent\\SafeOS\\SetupComplete.cmd.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.bdcddcbaad"), dwFlags=0x1) returned 1 [0138.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0138.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b960 [0138.894] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.894] SetLastError (dwErrCode=0x0) [0138.894] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] GetLastError () returned 0x0 [0138.895] SetLastError (dwErrCode=0x0) [0138.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0138.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FBEuSaEpUjB23rP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0138.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FBEuSaEpUjB23rP", cchWideChar=15, lpMultiByteStr=0x33ef610, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FBEuSaEpUjB23rP", lpUsedDefaultChar=0x0) returned 15 [0138.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0138.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0138.896] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x520b730 [0138.896] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0138.896] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\safeos\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0138.897] WriteFile (in: hFile=0x518, lpBuffer=0x520b730*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x520b730*, lpNumberOfBytesWritten=0x33ef748*=0xe62, lpOverlapped=0x0) returned 1 [0138.898] CloseHandle (hObject=0x518) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x520b730 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39afe0 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a28c0 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0138.899] CryptDestroyKey (hKey=0x5261308) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391838 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391aa8 | out: hHeap=0x310000) returned 1 [0138.899] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365458 | out: hHeap=0x310000) returned 1 [0138.899] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0138.899] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0138.900] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.900] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0138.910] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.910] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0138.911] CloseHandle (hObject=0x518) returned 1 [0138.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0138.911] RmStartSession () returned 0x0 [0138.915] RmRegisterResources () returned 0x0 [0138.919] RmGetList () returned 0x0 [0140.777] RmShutdown () returned 0x0 [0141.554] RmEndSession () returned 0x0 [0141.555] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x35da08) returned 1 [0141.555] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0141.556] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.556] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.556] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0141.556] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3702) returned 1 [0141.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0141.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677c020 [0141.576] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0141.576] ReadFile (in: hFile=0x518, lpBuffer=0x677c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x677c040*, lpNumberOfBytesRead=0x33ef7d4*=0xe76, lpOverlapped=0x0) returned 1 [0141.577] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0141.577] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0141.577] WriteFile (in: hFile=0x518, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0141.578] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0141.578] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0141.578] WriteFile (in: hFile=0x518, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0141.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677c020 | out: hHeap=0x310000) returned 1 [0141.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0141.583] CloseHandle (hObject=0x518) returned 1 [0141.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0141.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0141.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0141.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0141.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0141.585] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1035\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0141.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5158 [0141.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0141.616] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.616] SetLastError (dwErrCode=0x0) [0141.616] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b5a8 [0141.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.617] GetLastError () returned 0x0 [0141.617] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] GetLastError () returned 0x0 [0141.618] SetLastError (dwErrCode=0x0) [0141.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0141.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0141.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x38c2a0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RvQ78znxAxbgIhBd7BJgQH", lpUsedDefaultChar=0x0) returned 22 [0141.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b5a8 | out: hHeap=0x310000) returned 1 [0141.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0141.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5c96138 [0141.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39af68 [0141.618] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1035\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.618] WriteFile (in: hFile=0x518, lpBuffer=0x5c96138*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x5c96138*, lpNumberOfBytesWritten=0x33ef748*=0xe69, lpOverlapped=0x0) returned 1 [0141.619] CloseHandle (hObject=0x518) returned 1 [0141.866] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39af68 | out: hHeap=0x310000) returned 1 [0141.866] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c96138 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5158 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0141.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0141.995] CryptDestroyKey (hKey=0x35da08) returned 1 [0141.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0141.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399248 | out: hHeap=0x310000) returned 1 [0141.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19380 | out: hHeap=0x310000) returned 1 [0141.995] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0141.995] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0141.995] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.995] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0142.276] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.276] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0142.276] CloseHandle (hObject=0x69c) returned 1 [0142.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2108 [0142.277] RmStartSession () returned 0x0 [0142.296] RmRegisterResources () returned 0x0 [0142.300] RmGetList () returned 0x0 [0142.516] RmShutdown () returned 0x0 [0142.777] RmEndSession () returned 0x0 [0142.781] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261888) returned 1 [0142.781] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0142.781] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0142.781] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0142.782] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0142.782] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=86442) returned 1 [0142.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0142.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dcd020 [0142.927] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0142.927] ReadFile (in: hFile=0x69c, lpBuffer=0x4dcd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x4dcd040*, lpNumberOfBytesRead=0x33ef7d4*=0x151aa, lpOverlapped=0x0) returned 1 [0142.941] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0142.941] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.941] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.941] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.941] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.942] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.942] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.942] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.942] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.942] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.942] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.942] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.942] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.942] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.943] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.943] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.943] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.943] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.943] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.943] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.943] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.943] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0142.943] WriteFile (in: hFile=0x69c, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0142.944] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x69c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x69c, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0142.944] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dcd020 | out: hHeap=0x310000) returned 1 [0143.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0143.033] CloseHandle (hObject=0x69c) returned 1 [0143.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0143.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2240 [0143.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0143.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0143.036] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1038\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0143.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0143.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3982f0 [0143.037] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] GetLastError () returned 0x0 [0143.037] SetLastError (dwErrCode=0x0) [0143.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.037] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b8b8 [0143.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.038] SetLastError (dwErrCode=0x0) [0143.038] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365a98 [0143.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] GetLastError () returned 0x0 [0143.039] SetLastError (dwErrCode=0x0) [0143.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0143.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0143.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x38c1d8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", lpUsedDefaultChar=0x0) returned 28 [0143.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a98 | out: hHeap=0x310000) returned 1 [0143.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0143.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0143.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac20 [0143.039] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0143.074] WriteFile (in: hFile=0x698, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x33ef748*=0xe6f, lpOverlapped=0x0) returned 1 [0143.075] CloseHandle (hObject=0x698) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac20 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3982f0 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2240 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.075] CryptDestroyKey (hKey=0x5261888) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2108 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0143.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18f70 | out: hHeap=0x310000) returned 1 [0143.076] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0143.076] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0143.076] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.076] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.090] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0143.090] CloseHandle (hObject=0x698) returned 1 [0143.090] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0143.090] RmStartSession () returned 0x0 [0143.092] RmRegisterResources () returned 0x0 [0143.093] RmGetList () returned 0x0 [0145.381] RmShutdown () returned 0x0 [0148.805] RmEndSession () returned 0x0 [0148.806] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261388) returned 1 [0148.806] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0148.806] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0148.806] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0148.806] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0148.806] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=68226) returned 1 [0148.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3a4b20 [0148.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6849020 [0148.824] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0148.824] ReadFile (in: hFile=0x698, lpBuffer=0x6849040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x6849040*, lpNumberOfBytesRead=0x33ef7d4*=0x10a82, lpOverlapped=0x0) returned 1 [0148.929] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0148.929] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.929] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.929] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.929] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.929] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.929] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0148.930] WriteFile (in: hFile=0x698, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0148.931] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0148.931] WriteFile (in: hFile=0x698, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0148.931] WriteFile (in: hFile=0x698, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0148.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6849020 | out: hHeap=0x310000) returned 1 [0149.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b20 | out: hHeap=0x310000) returned 1 [0149.037] CloseHandle (hObject=0x698) returned 1 [0149.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0149.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2f00 [0149.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0149.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0149.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2f00 | out: hHeap=0x310000) returned 1 [0149.039] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1041\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0149.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0149.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0149.040] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0149.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0149.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0149.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0149.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x38c3e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JuH0I4bPusHDEdIv", lpUsedDefaultChar=0x0) returned 16 [0149.041] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0149.041] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39fd0 [0149.042] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1041\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0149.101] WriteFile (in: hFile=0x4ac, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x33ef748*=0xe63, lpOverlapped=0x0) returned 1 [0149.102] CloseHandle (hObject=0x4ac) returned 1 [0149.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39fd0 | out: hHeap=0x310000) returned 1 [0149.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0149.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0149.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0149.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0149.104] CryptDestroyKey (hKey=0x5261388) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0149.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18fc0 | out: hHeap=0x310000) returned 1 [0149.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0149.104] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0149.104] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.104] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0149.119] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.119] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0149.119] CloseHandle (hObject=0x4ac) returned 1 [0149.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0149.120] RmStartSession () returned 0x0 [0149.121] RmRegisterResources () returned 0x0 [0149.125] RmGetList () returned 0x0 [0149.649] RmShutdown () returned 0x0 [0150.753] RmEndSession () returned 0x0 [0150.754] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260e08) returned 1 [0150.754] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0150.754] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x80) returned 1 [0150.754] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0150.754] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0150.754] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3069) returned 1 [0150.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0150.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5907020 [0151.082] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0151.082] ReadFile (in: hFile=0x4ac, lpBuffer=0x5907040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x5907040*, lpNumberOfBytesRead=0x33ef7d4*=0xbfd, lpOverlapped=0x0) returned 1 [0151.084] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0151.084] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0151.084] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0151.084] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0151.084] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0151.084] WriteFile (in: hFile=0x4ac, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0151.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5907020 | out: hHeap=0x310000) returned 1 [0152.195] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0152.195] CloseHandle (hObject=0x4ac) returned 1 [0152.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0152.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1fd0 [0152.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0152.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1d60 [0152.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1fd0 | out: hHeap=0x310000) returned 1 [0152.196] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\3082\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0152.197] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a88 [0152.197] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0152.197] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0152.197] GetLastError () returned 0x0 [0152.197] SetLastError (dwErrCode=0x0) [0152.197] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0152.197] GetLastError () returned 0x0 [0152.197] SetLastError (dwErrCode=0x0) [0152.197] GetLastError () returned 0x0 [0152.197] SetLastError (dwErrCode=0x0) [0152.197] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] GetLastError () returned 0x0 [0152.198] SetLastError (dwErrCode=0x0) [0152.198] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0152.199] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5351ac0 [0152.199] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] GetLastError () returned 0x0 [0152.199] SetLastError (dwErrCode=0x0) [0152.199] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0152.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0152.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x38c390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sHbaIgxKQiPPpPi01TvxwcKf8q", lpUsedDefaultChar=0x0) returned 26 [0152.199] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351ac0 | out: hHeap=0x310000) returned 1 [0152.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0152.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0152.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0180 [0152.200] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0152.200] WriteFile (in: hFile=0x4ac, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x33ef748*=0xe6d, lpOverlapped=0x0) returned 1 [0152.201] CloseHandle (hObject=0x4ac) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0180 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a88 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1d60 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0152.202] CryptDestroyKey (hKey=0x5260e08) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e51b0 | out: hHeap=0x310000) returned 1 [0152.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c194c0 | out: hHeap=0x310000) returned 1 [0152.202] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0152.202] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0152.202] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.202] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0152.236] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.236] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0152.236] CloseHandle (hObject=0x4ac) returned 1 [0152.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2580 [0152.237] RmStartSession () returned 0x0 [0152.304] RmRegisterResources () returned 0x0 [0152.309] RmGetList () returned 0x0 [0152.667] RmShutdown () returned 0x0 [0153.613] RmEndSession () returned 0x0 [0154.093] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261748) returned 1 [0154.093] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0154.093] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico", dwFileAttributes=0x80) returned 1 [0154.093] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0154.093] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0154.093] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=894) returned 1 [0154.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0154.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6218020 [0154.110] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0154.110] ReadFile (in: hFile=0x66c, lpBuffer=0x6218040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x6218040*, lpNumberOfBytesRead=0x33ef7d4*=0x37e, lpOverlapped=0x0) returned 1 [0154.149] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0154.149] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0154.149] WriteFile (in: hFile=0x66c, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0154.150] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0154.150] WriteFile (in: hFile=0x66c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0154.150] WriteFile (in: hFile=0x66c, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0154.150] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6218020 | out: hHeap=0x310000) returned 1 [0154.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0154.155] CloseHandle (hObject=0x66c) returned 1 [0154.156] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0154.156] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f02e8 [0154.156] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0154.156] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0bd0 [0154.156] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f02e8 | out: hHeap=0x310000) returned 1 [0154.156] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0154.157] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0154.157] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0154.157] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0154.157] GetLastError () returned 0x0 [0154.157] SetLastError (dwErrCode=0x0) [0154.158] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0154.158] GetLastError () returned 0x0 [0154.158] SetLastError (dwErrCode=0x0) [0154.158] GetLastError () returned 0x0 [0154.158] SetLastError (dwErrCode=0x0) [0154.158] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0154.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0154.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x33ef610, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0154.158] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0154.158] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0154.158] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0154.159] WriteFile (in: hFile=0x66c, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x33ef748*=0xe54, lpOverlapped=0x0) returned 1 [0154.160] CloseHandle (hObject=0x66c) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0bd0 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0154.160] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0154.160] CryptDestroyKey (hKey=0x5261748) returned 1 [0154.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2580 | out: hHeap=0x310000) returned 1 [0154.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060cb0 | out: hHeap=0x310000) returned 1 [0154.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5bc0 | out: hHeap=0x310000) returned 1 [0154.161] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0154.161] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0154.161] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.161] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0154.319] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.319] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0154.319] CloseHandle (hObject=0x66c) returned 1 [0154.319] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2580 [0154.319] RmStartSession () returned 0x0 [0156.049] RmRegisterResources () returned 0x0 [0156.055] RmGetList () returned 0x0 [0156.448] RmShutdown () returned 0x0 [0157.461] RmEndSession () returned 0x0 [0157.708] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261788) returned 1 [0157.708] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0157.708] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi", dwFileAttributes=0x80) returned 1 [0157.708] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0157.708] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0157.708] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=1901056) returned 1 [0157.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bba5a8 [0157.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6adf020 [0157.796] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0157.796] ReadFile (in: hFile=0x670, lpBuffer=0x6adf040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x6adf040*, lpNumberOfBytesRead=0x33ef7d4*=0x100000, lpOverlapped=0x0) returned 1 [0157.865] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0157.865] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.870] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.870] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.870] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.870] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.870] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.870] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.870] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.871] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.871] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.872] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.872] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.873] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.873] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0157.874] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0157.874] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.551] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.551] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.551] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.551] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.551] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.551] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.551] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.551] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.551] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.551] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.552] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.552] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.553] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.553] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.554] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.555] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.555] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.556] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.556] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.557] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.558] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.558] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.559] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.559] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.560] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.560] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.561] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.561] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.562] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.562] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.562] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.562] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.562] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.562] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.562] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.562] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.563] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.563] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.564] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.564] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba5c0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0158.565] WriteFile (in: hFile=0x670, lpBuffer=0x4bba5c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4bba5c0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0158.565] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0158.566] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0158.566] WriteFile (in: hFile=0x670, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0158.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6adf020 | out: hHeap=0x310000) returned 1 [0161.445] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba5a8 | out: hHeap=0x310000) returned 1 [0161.445] CloseHandle (hObject=0x670) returned 1 [0161.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0161.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0161.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0161.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0161.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0161.609] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0161.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3a8 [0161.610] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] GetLastError () returned 0x0 [0161.610] SetLastError (dwErrCode=0x0) [0161.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0161.610] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0161.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.611] GetLastError () returned 0x0 [0161.611] SetLastError (dwErrCode=0x0) [0161.612] GetLastError () returned 0x0 [0161.612] SetLastError (dwErrCode=0x0) [0161.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0161.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0161.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0161.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x38c160, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asZJGyY6zFo1elxK4hBU7cY", lpUsedDefaultChar=0x0) returned 23 [0161.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0161.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0161.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bab400 [0161.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0161.612] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0161.613] WriteFile (in: hFile=0x670, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x33ef748*=0xe6a, lpOverlapped=0x0) returned 1 [0161.614] CloseHandle (hObject=0x670) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3a8 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0161.614] CryptDestroyKey (hKey=0x5261788) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2580 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060e50 | out: hHeap=0x310000) returned 1 [0161.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5d00 | out: hHeap=0x310000) returned 1 [0161.614] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0161.614] CreateFileW (lpFileName="C:\\\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0161.615] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.615] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0161.768] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.768] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0161.768] CloseHandle (hObject=0x670) returned 1 [0161.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980b0 [0161.768] RmStartSession () returned 0x0 [0162.545] RmRegisterResources () returned 0x0 [0162.556] RmGetList () returned 0x0 [0163.274] RmShutdown () returned 0x0 [0164.595] RmEndSession () returned 0x0 [0164.719] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261888) returned 1 [0164.719] GetFileAttributesW (lpFileName="C:\\\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0164.719] SetFileAttributesW (lpFileName="C:\\\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x20) returned 1 [0164.720] CreateFileW (lpFileName="C:\\\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0164.720] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0164.720] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=69632) returned 1 [0164.720] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5207008 [0164.720] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0164.743] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0164.743] ReadFile (in: hFile=0x650, lpBuffer=0x6219040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x6219040*, lpNumberOfBytesRead=0x33ef7d4*=0x11000, lpOverlapped=0x0) returned 1 [0165.432] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0165.432] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.432] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.432] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.432] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.432] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.433] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5207020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0165.433] WriteFile (in: hFile=0x650, lpBuffer=0x5207020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5207020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0165.434] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0165.434] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0165.434] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0165.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6219020 | out: hHeap=0x310000) returned 1 [0167.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5207008 | out: hHeap=0x310000) returned 1 [0167.643] CloseHandle (hObject=0x650) returned 1 [0167.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f00 [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3982f0 [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0167.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f00 | out: hHeap=0x310000) returned 1 [0167.646] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="C:\\\\Logs\\Internet Explorer.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\internet explorer.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398380 [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0167.646] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0167.646] GetLastError () returned 0x0 [0167.646] SetLastError (dwErrCode=0x0) [0167.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a42a8 [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] GetLastError () returned 0x0 [0167.647] SetLastError (dwErrCode=0x0) [0167.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a42a8 | out: hHeap=0x310000) returned 1 [0167.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0167.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x33ef610, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8hSHAmSXv4", lpUsedDefaultChar=0x0) returned 11 [0167.648] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0167.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0167.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398068 [0167.648] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0167.648] WriteFile (in: hFile=0x650, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x33ef748*=0xe5e, lpOverlapped=0x0) returned 1 [0167.649] CloseHandle (hObject=0x650) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398068 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398380 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3982f0 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0167.650] CryptDestroyKey (hKey=0x5261888) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980b0 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0167.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18de0 | out: hHeap=0x310000) returned 1 [0167.650] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0167.650] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0167.650] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.650] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0167.664] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.664] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0167.664] CloseHandle (hObject=0x650) returned 1 [0167.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0167.664] RmStartSession () returned 0x0 [0167.667] RmRegisterResources () returned 0x0 [0167.671] RmGetList () returned 0x0 [0170.073] RmShutdown () returned 0x0 [0174.905] RmEndSession () returned 0x0 [0174.906] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261a88) returned 1 [0174.906] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0174.906] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0174.906] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0174.906] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0174.907] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=69632) returned 1 [0174.907] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x51c7a30 [0174.907] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6faa020 [0175.698] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0175.698] ReadFile (in: hFile=0x650, lpBuffer=0x6faa040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x6faa040*, lpNumberOfBytesRead=0x33ef7d4*=0x11000, lpOverlapped=0x0) returned 1 [0175.700] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0175.700] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.700] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.701] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.701] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.702] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c7a40*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0175.702] WriteFile (in: hFile=0x650, lpBuffer=0x51c7a40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x51c7a40*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0175.702] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0175.702] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0175.702] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0175.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6faa020 | out: hHeap=0x310000) returned 1 [0176.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c7a30 | out: hHeap=0x310000) returned 1 [0176.750] CloseHandle (hObject=0x650) returned 1 [0176.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0176.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53218b8 [0176.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0176.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322958 [0176.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53218b8 | out: hHeap=0x310000) returned 1 [0176.752] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0176.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0bd0 [0176.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0176.753] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0176.753] GetLastError () returned 0x0 [0176.753] SetLastError (dwErrCode=0x0) [0176.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0176.753] GetLastError () returned 0x0 [0176.753] SetLastError (dwErrCode=0x0) [0176.753] GetLastError () returned 0x0 [0176.753] SetLastError (dwErrCode=0x0) [0176.753] GetLastError () returned 0x0 [0176.753] SetLastError (dwErrCode=0x0) [0176.753] GetLastError () returned 0x0 [0176.753] SetLastError (dwErrCode=0x0) [0176.753] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] GetLastError () returned 0x0 [0176.754] SetLastError (dwErrCode=0x0) [0176.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0176.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x33ef610, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mLGY6f92w4A", lpUsedDefaultChar=0x0) returned 11 [0176.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0176.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0176.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0176.754] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0176.755] WriteFile (in: hFile=0x650, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x33ef748*=0xe5e, lpOverlapped=0x0) returned 1 [0176.756] CloseHandle (hObject=0x650) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0bd0 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322958 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0176.757] CryptDestroyKey (hKey=0x5261a88) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae00 | out: hHeap=0x310000) returned 1 [0176.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18f70 | out: hHeap=0x310000) returned 1 [0176.757] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0176.757] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0176.757] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.758] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0176.759] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.759] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0176.759] CloseHandle (hObject=0x650) returned 1 [0176.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4880 [0176.760] RmStartSession () returned 0x0 [0176.762] RmRegisterResources () returned 0x0 [0176.765] RmGetList () returned 0x0 [0180.538] RmShutdown () returned 0x0 [0182.767] RmEndSession () returned 0x0 [0182.959] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261888) returned 1 [0182.959] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0182.959] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x20) returned 1 [0182.959] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0182.960] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0182.960] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=1052672) returned 1 [0182.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5413ca0 [0182.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf2020 [0182.978] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0182.978] ReadFile (in: hFile=0x650, lpBuffer=0x4cf2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x4cf2040*, lpNumberOfBytesRead=0x33ef7d4*=0x100000, lpOverlapped=0x0) returned 1 [0183.031] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0183.031] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.031] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.031] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.031] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.031] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.031] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.031] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.031] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.032] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.032] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.033] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.033] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.034] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.034] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.035] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.035] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.036] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.036] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.037] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.038] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.038] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.039] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.039] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.040] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.040] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.041] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.041] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.041] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.041] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.041] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.041] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.483] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.484] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.486] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.487] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.488] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.489] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.489] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.489] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.489] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.489] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.490] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.490] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.492] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.492] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.498] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.498] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.498] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.498] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.498] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.498] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.499] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.499] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.500] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.500] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.501] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.501] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.502] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.502] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.503] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.503] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.504] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.504] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.505] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.505] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.505] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.505] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.505] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0183.505] WriteFile (in: hFile=0x650, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0183.505] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0183.505] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0183.514] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0183.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf2020 | out: hHeap=0x310000) returned 1 [0185.387] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5413ca0 | out: hHeap=0x310000) returned 1 [0185.387] CloseHandle (hObject=0x650) returned 1 [0185.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0185.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0185.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0185.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0185.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0185.409] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0185.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0185.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0185.410] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0185.410] GetLastError () returned 0x0 [0185.410] SetLastError (dwErrCode=0x0) [0185.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0185.410] GetLastError () returned 0x0 [0185.410] SetLastError (dwErrCode=0x0) [0185.410] GetLastError () returned 0x0 [0185.411] SetLastError (dwErrCode=0x0) [0185.411] GetLastError () returned 0x0 [0185.411] SetLastError (dwErrCode=0x0) [0185.411] GetLastError () returned 0x0 [0185.411] SetLastError (dwErrCode=0x0) [0185.411] GetLastError () returned 0x0 [0185.411] SetLastError (dwErrCode=0x0) [0185.411] GetLastError () returned 0x0 [0185.411] SetLastError (dwErrCode=0x0) [0185.411] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x33ef610, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7L6vG", lpUsedDefaultChar=0x0) returned 5 [0185.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0185.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0185.411] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0185.412] WriteFile (in: hFile=0x650, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x33ef748*=0xe58, lpOverlapped=0x0) returned 1 [0185.413] CloseHandle (hObject=0x650) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0185.413] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0185.414] CryptDestroyKey (hKey=0x5261888) returned 1 [0185.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4880 | out: hHeap=0x310000) returned 1 [0185.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea9c8 | out: hHeap=0x310000) returned 1 [0185.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6650 | out: hHeap=0x310000) returned 1 [0185.414] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0185.414] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0185.414] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.414] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0185.816] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.816] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0185.816] CloseHandle (hObject=0x650) returned 1 [0185.816] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0180 [0185.816] RmStartSession () returned 0x0 [0186.205] RmRegisterResources () returned 0x0 [0186.209] RmGetList () returned 0x0 [0187.159] RmShutdown () returned 0x0 [0187.457] RmEndSession () returned 0x0 [0187.458] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261308) returned 1 [0187.458] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0187.459] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0187.459] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0187.459] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0187.459] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=69632) returned 1 [0187.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2038 [0187.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b8020 [0187.774] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0187.774] ReadFile (in: hFile=0x650, lpBuffer=0x64b8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x64b8040*, lpNumberOfBytesRead=0x33ef7d4*=0x11000, lpOverlapped=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0187.776] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.776] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.777] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.778] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0187.778] WriteFile (in: hFile=0x650, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0187.778] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0187.778] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0187.778] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0187.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b8020 | out: hHeap=0x310000) returned 1 [0188.373] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2038 | out: hHeap=0x310000) returned 1 [0188.373] CloseHandle (hObject=0x650) returned 1 [0188.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0188.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0188.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0108 [0188.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0188.376] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0188.376] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0188.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0188.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0188.376] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.377] SetLastError (dwErrCode=0x0) [0188.377] GetLastError () returned 0x0 [0188.378] SetLastError (dwErrCode=0x0) [0188.378] GetLastError () returned 0x0 [0188.378] SetLastError (dwErrCode=0x0) [0188.378] GetLastError () returned 0x0 [0188.378] SetLastError (dwErrCode=0x0) [0188.378] GetLastError () returned 0x0 [0188.378] SetLastError (dwErrCode=0x0) [0188.378] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0188.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ghQUkMJPBpzr5nf", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0188.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ghQUkMJPBpzr5nf", cchWideChar=15, lpMultiByteStr=0x33ef610, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghQUkMJPBpzr5nf", lpUsedDefaultChar=0x0) returned 15 [0188.378] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0188.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540d6a0 [0188.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540e528 [0188.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0188.378] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0188.379] WriteFile (in: hFile=0x650, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x33ef748*=0xe62, lpOverlapped=0x0) returned 1 [0188.380] CloseHandle (hObject=0x650) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0108 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0188.380] CryptDestroyKey (hKey=0x5261308) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0180 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0188.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6b00 | out: hHeap=0x310000) returned 1 [0188.380] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0188.380] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0188.381] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.381] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0188.405] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.405] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0188.405] CloseHandle (hObject=0x650) returned 1 [0188.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0188.406] RmStartSession () returned 0x0 [0188.409] RmRegisterResources () returned 0x0 [0188.413] RmGetList () returned 0x0 [0190.660] RmShutdown () returned 0x0 [0191.971] RmEndSession () returned 0x0 [0192.010] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x35db08) returned 1 [0192.010] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0192.010] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0192.010] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0192.010] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0192.010] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=69632) returned 1 [0192.010] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61ba0e8 [0192.010] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5624020 [0192.028] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0192.029] ReadFile (in: hFile=0x650, lpBuffer=0x5624040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x5624040*, lpNumberOfBytesRead=0x33ef7d4*=0x11000, lpOverlapped=0x0) returned 1 [0192.070] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0192.070] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.070] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.071] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.071] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.072] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.072] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.072] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0192.072] WriteFile (in: hFile=0x650, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0192.072] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0192.072] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0192.082] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0192.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5624020 | out: hHeap=0x310000) returned 1 [0192.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61ba0e8 | out: hHeap=0x310000) returned 1 [0192.087] CloseHandle (hObject=0x650) returned 1 [0192.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0192.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c96c8 [0192.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327390 [0192.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9e00 [0192.241] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c96c8 | out: hHeap=0x310000) returned 1 [0192.242] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0192.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327428 [0192.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0192.242] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0192.242] GetLastError () returned 0x0 [0192.242] SetLastError (dwErrCode=0x0) [0192.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.243] SetLastError (dwErrCode=0x0) [0192.243] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b810 [0192.244] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] GetLastError () returned 0x0 [0192.244] SetLastError (dwErrCode=0x0) [0192.244] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bae568 [0192.244] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b810 | out: hHeap=0x310000) returned 1 [0192.244] GetLastError () returned 0x0 [0192.245] SetLastError (dwErrCode=0x0) [0192.245] GetLastError () returned 0x0 [0192.245] SetLastError (dwErrCode=0x0) [0192.245] GetLastError () returned 0x0 [0192.245] SetLastError (dwErrCode=0x0) [0192.245] GetLastError () returned 0x0 [0192.245] SetLastError (dwErrCode=0x0) [0192.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0192.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cCLR5eSe3IpcY0EuOY9ZMnkecsCt", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0192.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0192.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cCLR5eSe3IpcY0EuOY9ZMnkecsCt", cchWideChar=28, lpMultiByteStr=0x38c4d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cCLR5eSe3IpcY0EuOY9ZMnkecsCt", lpUsedDefaultChar=0x0) returned 28 [0192.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bae568 | out: hHeap=0x310000) returned 1 [0192.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5409c80 [0192.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540b990 [0192.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b10 [0192.245] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0192.246] WriteFile (in: hFile=0x650, lpBuffer=0x540b990*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x540b990*, lpNumberOfBytesWritten=0x33ef748*=0xe6f, lpOverlapped=0x0) returned 1 [0192.247] CloseHandle (hObject=0x650) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327428 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9e00 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327390 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0192.248] CryptDestroyKey (hKey=0x35db08) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c1e8 | out: hHeap=0x310000) returned 1 [0192.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c50 | out: hHeap=0x310000) returned 1 [0192.248] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0192.248] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0192.249] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.249] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0192.313] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.313] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0192.313] CloseHandle (hObject=0x650) returned 1 [0192.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0192.314] RmStartSession () returned 0x0 [0192.439] RmRegisterResources () returned 0x0 [0192.443] RmGetList () returned 0x0 [0193.075] RmShutdown () returned 0x0 [0193.365] RmEndSession () returned 0x0 [0193.366] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260f88) returned 1 [0193.366] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0193.366] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", dwFileAttributes=0x20) returned 1 [0193.366] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0193.366] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0193.367] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=15984) returned 1 [0193.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0193.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ea020 [0193.385] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0193.779] ReadFile (in: hFile=0x650, lpBuffer=0x49ea040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x49ea040*, lpNumberOfBytesRead=0x33ef7d4*=0x3e70, lpOverlapped=0x0) returned 1 [0193.795] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0193.795] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0193.795] WriteFile (in: hFile=0x650, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0193.795] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0193.795] WriteFile (in: hFile=0x650, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0193.796] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0193.796] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0193.796] WriteFile (in: hFile=0x650, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0193.796] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ea020 | out: hHeap=0x310000) returned 1 [0193.978] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0193.979] CloseHandle (hObject=0x650) returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0193.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0193.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0193.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0193.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0193.979] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), lpNewFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0c48 [0193.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0193.980] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0193.980] GetLastError () returned 0x0 [0193.980] SetLastError (dwErrCode=0x0) [0193.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0193.980] GetLastError () returned 0x0 [0193.980] SetLastError (dwErrCode=0x0) [0193.980] GetLastError () returned 0x0 [0193.980] SetLastError (dwErrCode=0x0) [0193.980] GetLastError () returned 0x0 [0193.980] SetLastError (dwErrCode=0x0) [0193.980] GetLastError () returned 0x0 [0193.980] SetLastError (dwErrCode=0x0) [0193.980] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x33ef610, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwY", lpUsedDefaultChar=0x0) returned 3 [0193.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540d6a0 [0193.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0193.980] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\designer\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0193.981] WriteFile (in: hFile=0x650, lpBuffer=0x540d6a0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x540d6a0*, lpNumberOfBytesWritten=0x33ef748*=0xe56, lpOverlapped=0x0) returned 1 [0193.982] CloseHandle (hObject=0x650) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0c48 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0193.982] CryptDestroyKey (hKey=0x5260f88) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19fd8 | out: hHeap=0x310000) returned 1 [0193.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44718 | out: hHeap=0x310000) returned 1 [0193.983] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0193.983] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0193.983] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.983] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0194.017] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.018] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0194.018] CloseHandle (hObject=0x650) returned 1 [0194.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0194.018] RmStartSession () returned 0x0 [0194.291] RmRegisterResources () returned 0x0 [0194.295] RmGetList () returned 0x0 [0196.362] RmShutdown () returned 0x0 [0198.971] RmEndSession () returned 0x0 [0198.972] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261308) returned 1 [0198.972] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0198.972] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0198.972] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.972] CryptDestroyKey (hKey=0x5261308) returned 1 [0198.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0198.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92cb8 | out: hHeap=0x310000) returned 1 [0198.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44948 | out: hHeap=0x310000) returned 1 [0198.972] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0198.972] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0198.973] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.973] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0199.042] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.042] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0199.043] CloseHandle (hObject=0x574) returned 1 [0199.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x51bafa8 [0199.043] RmStartSession () returned 0x0 [0199.046] RmRegisterResources () returned 0x0 [0199.050] RmGetList () returned 0x0 [0200.707] RmShutdown () returned 0x0 [0204.731] RmEndSession () returned 0x0 [0204.873] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261048) returned 1 [0204.873] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0204.873] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", dwFileAttributes=0x20) returned 0 [0204.874] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.874] CryptDestroyKey (hKey=0x5261048) returned 1 [0204.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bafa8 | out: hHeap=0x310000) returned 1 [0204.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390830 | out: hHeap=0x310000) returned 1 [0204.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07c90 | out: hHeap=0x310000) returned 1 [0204.874] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0204.874] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0204.955] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.955] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0204.957] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.957] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0204.957] CloseHandle (hObject=0x5d4) returned 1 [0204.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53eaf80 [0204.957] RmStartSession () returned 0x0 [0205.080] RmRegisterResources () returned 0x0 [0205.084] RmGetList () returned 0x0 [0206.289] RmShutdown () returned 0x0 [0206.748] RmEndSession () returned 0x0 [0206.748] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260fc8) returned 1 [0206.749] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0206.749] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", dwFileAttributes=0x20) returned 0 [0206.749] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.749] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0206.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53eaf80 | out: hHeap=0x310000) returned 1 [0206.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc438 | out: hHeap=0x310000) returned 1 [0206.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08640 | out: hHeap=0x310000) returned 1 [0206.749] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0206.749] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0206.749] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.749] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0206.787] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.787] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0206.787] CloseHandle (hObject=0x640) returned 1 [0206.787] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53eb0f0 [0206.787] RmStartSession () returned 0x0 [0206.860] RmRegisterResources () returned 0x0 [0206.864] RmGetList () returned 0x0 [0207.422] RmShutdown () returned 0x0 [0209.989] RmEndSession () returned 0x0 [0210.245] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260fc8) returned 1 [0210.245] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0210.245] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", dwFileAttributes=0x20) returned 0 [0210.245] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.245] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0210.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53eb0f0 | out: hHeap=0x310000) returned 1 [0210.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbfe8 | out: hHeap=0x310000) returned 1 [0210.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08730 | out: hHeap=0x310000) returned 1 [0210.245] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0210.245] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0210.246] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.246] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0210.247] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.248] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0210.248] CloseHandle (hObject=0x640) returned 1 [0210.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f8808 [0210.248] RmStartSession () returned 0x0 [0210.288] RmRegisterResources () returned 0x0 [0210.292] RmGetList () returned 0x0 [0211.209] RmShutdown () returned 0x0 [0213.446] RmEndSession () returned 0x0 [0213.754] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260d88) returned 1 [0213.754] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0213.754] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", dwFileAttributes=0x20) returned 0 [0213.754] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.755] CryptDestroyKey (hKey=0x5260d88) returned 1 [0213.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f8808 | out: hHeap=0x310000) returned 1 [0213.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ed168 | out: hHeap=0x310000) returned 1 [0213.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5830 | out: hHeap=0x310000) returned 1 [0213.755] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0213.755] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0213.755] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.755] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0213.794] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.794] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0213.794] CloseHandle (hObject=0x660) returned 1 [0213.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd180 [0213.794] RmStartSession () returned 0x0 [0213.796] RmRegisterResources () returned 0x0 [0213.796] RmGetList () returned 0x0 [0213.963] RmShutdown () returned 0x0 [0218.778] RmEndSession () returned 0x0 [0218.779] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261008) returned 1 [0218.779] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0218.779] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml", dwFileAttributes=0x20) returned 0 [0218.780] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.780] CryptDestroyKey (hKey=0x5261008) returned 1 [0218.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd180 | out: hHeap=0x310000) returned 1 [0218.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9fb0 | out: hHeap=0x310000) returned 1 [0218.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a56f0 | out: hHeap=0x310000) returned 1 [0218.780] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0218.780] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0218.781] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.781] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0218.808] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.809] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0218.809] CloseHandle (hObject=0x660) returned 1 [0218.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bccb8 [0218.809] RmStartSession () returned 0x0 [0218.811] RmRegisterResources () returned 0x0 [0218.812] RmGetList () returned 0x0 [0219.606] RmShutdown () returned 0x0 [0221.948] RmEndSession () returned 0x0 [0222.309] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261308) returned 1 [0222.309] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0222.309] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml", dwFileAttributes=0x20) returned 0 [0222.309] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.309] CryptDestroyKey (hKey=0x5261308) returned 1 [0222.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bccb8 | out: hHeap=0x310000) returned 1 [0222.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb798 | out: hHeap=0x310000) returned 1 [0222.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c141f0 | out: hHeap=0x310000) returned 1 [0222.310] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0222.310] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0222.310] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.310] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0222.316] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.316] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0222.316] CloseHandle (hObject=0x660) returned 1 [0222.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0222.316] RmStartSession () returned 0x0 [0222.402] RmRegisterResources () returned 0x0 [0222.403] RmGetList () returned 0x0 [0223.303] RmShutdown () returned 0x0 [0224.550] RmEndSession () returned 0x0 [0224.593] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261848) returned 1 [0224.593] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0224.594] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0224.594] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.594] CryptDestroyKey (hKey=0x5261848) returned 1 [0224.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0224.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eea80 | out: hHeap=0x310000) returned 1 [0224.594] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c149c0 | out: hHeap=0x310000) returned 1 [0224.594] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0224.594] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0224.594] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.594] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0224.661] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.662] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0224.662] CloseHandle (hObject=0x678) returned 1 [0224.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3ee150 [0224.662] RmStartSession () returned 0x0 [0224.664] RmRegisterResources () returned 0x0 [0224.664] RmGetList () returned 0x0 [0225.357] RmShutdown () returned 0x0 [0229.754] RmEndSession () returned 0x0 [0229.840] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261348) returned 1 [0229.840] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0229.840] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", dwFileAttributes=0x20) returned 0 [0229.841] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.841] CryptDestroyKey (hKey=0x5261348) returned 1 [0229.841] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee150 | out: hHeap=0x310000) returned 1 [0229.841] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee930 | out: hHeap=0x310000) returned 1 [0229.841] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14510 | out: hHeap=0x310000) returned 1 [0229.841] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0229.841] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0229.841] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.841] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0229.887] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.887] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0229.887] CloseHandle (hObject=0x678) returned 1 [0229.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0229.887] RmStartSession () returned 0x0 [0229.889] RmRegisterResources () returned 0x0 [0229.889] RmGetList () returned 0x0 [0230.828] RmShutdown () returned 0x0 [0232.509] RmEndSession () returned 0x0 [0232.510] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261608) returned 1 [0232.510] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0232.510] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado26.tlb", dwFileAttributes=0x20) returned 0 [0232.511] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.511] CryptDestroyKey (hKey=0x5261608) returned 1 [0232.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0232.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a140 | out: hHeap=0x310000) returned 1 [0232.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18f20 | out: hHeap=0x310000) returned 1 [0232.511] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0232.511] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0232.511] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.511] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0232.513] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.513] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0232.513] CloseHandle (hObject=0x678) returned 1 [0232.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0232.513] RmStartSession () returned 0x0 [0232.515] RmRegisterResources () returned 0x0 [0232.519] RmGetList () returned 0x0 [0234.633] RmShutdown () returned 0x0 [0235.326] RmEndSession () returned 0x0 [0235.327] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261788) returned 1 [0235.327] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0235.327] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", dwFileAttributes=0x20) returned 0 [0235.327] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.327] CryptDestroyKey (hKey=0x5261788) returned 1 [0235.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0235.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571770 | out: hHeap=0x310000) returned 1 [0235.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572a68 | out: hHeap=0x310000) returned 1 [0235.328] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0235.328] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0235.328] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.328] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0235.366] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.366] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0235.366] CloseHandle (hObject=0x678) returned 1 [0235.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0235.366] RmStartSession () returned 0x0 [0235.369] RmRegisterResources () returned 0x0 [0235.373] RmGetList () returned 0x0 [0236.877] RmShutdown () returned 0x0 [0237.840] RmEndSession () returned 0x0 [0238.445] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261488) returned 1 [0238.445] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0238.445] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", dwFileAttributes=0x20) returned 1 [0238.445] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0238.445] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0238.445] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3244) returned 1 [0238.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5efb0 [0238.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5807020 [0238.464] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0238.464] ReadFile (in: hFile=0x678, lpBuffer=0x5807040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x5807040*, lpNumberOfBytesRead=0x33ef7d4*=0xcac, lpOverlapped=0x0) returned 1 [0238.513] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0238.513] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5efc0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5efc0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0238.513] WriteFile (in: hFile=0x678, lpBuffer=0x4b5efc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4b5efc0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0238.514] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0238.514] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0238.514] WriteFile (in: hFile=0x678, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0238.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5807020 | out: hHeap=0x310000) returned 1 [0238.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5efb0 | out: hHeap=0x310000) returned 1 [0238.519] CloseHandle (hObject=0x678) returned 1 [0238.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0238.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0238.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0238.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0238.519] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0238.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399140 [0238.520] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] GetLastError () returned 0x0 [0238.520] SetLastError (dwErrCode=0x0) [0238.520] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b650 [0238.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0238.521] GetLastError () returned 0x0 [0238.521] SetLastError (dwErrCode=0x0) [0238.521] GetLastError () returned 0x0 [0238.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0238.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x38c0c0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VMExNofJE4VFz9a2IHu", lpUsedDefaultChar=0x0) returned 19 [0238.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0238.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0238.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0238.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0238.522] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0238.522] WriteFile (in: hFile=0x678, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x33ef748*=0xe66, lpOverlapped=0x0) returned 1 [0238.523] CloseHandle (hObject=0x678) returned 1 [0238.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0238.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0238.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399140 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.524] CryptDestroyKey (hKey=0x5261488) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2108 | out: hHeap=0x310000) returned 1 [0238.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571ed8 | out: hHeap=0x310000) returned 1 [0238.524] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0238.524] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0238.524] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.524] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0239.115] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.115] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0239.115] CloseHandle (hObject=0x678) returned 1 [0239.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0239.115] RmStartSession () returned 0x0 [0239.336] RmRegisterResources () returned 0x0 [0239.336] RmGetList () returned 0x0 [0239.441] RmShutdown () returned 0x0 [0240.136] RmEndSession () returned 0x0 [0240.313] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52611c8) returned 1 [0240.313] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0240.313] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties", dwFileAttributes=0x20) returned 1 [0240.313] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0240.313] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0240.313] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3600) returned 1 [0240.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5cf70 [0240.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b4020 [0240.332] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0240.332] ReadFile (in: hFile=0x518, lpBuffer=0x64b4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x64b4040*, lpNumberOfBytesRead=0x33ef7d4*=0xe10, lpOverlapped=0x0) returned 1 [0240.346] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0240.346] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0240.346] WriteFile (in: hFile=0x518, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0240.347] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0240.347] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0240.347] WriteFile (in: hFile=0x518, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0240.347] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b4020 | out: hHeap=0x310000) returned 1 [0240.352] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5cf70 | out: hHeap=0x310000) returned 1 [0240.352] CloseHandle (hObject=0x518) returned 1 [0240.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0240.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcd90 [0240.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0240.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc888 [0240.352] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0240.352] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0240.353] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0240.353] GetLastError () returned 0x0 [0240.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i6wA2DFQuIvsE0M68KGbjpjLz", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0240.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i6wA2DFQuIvsE0M68KGbjpjLz", cchWideChar=25, lpMultiByteStr=0x38c1d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i6wA2DFQuIvsE0M68KGbjpjLz", lpUsedDefaultChar=0x0) returned 25 [0240.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e5a20 | out: hHeap=0x310000) returned 1 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0240.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0240.354] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0240.378] WriteFile (in: hFile=0x484, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x33ef748*=0xe6c, lpOverlapped=0x0) returned 1 [0240.379] CloseHandle (hObject=0x484) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc888 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0240.380] CryptDestroyKey (hKey=0x52611c8) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570930 | out: hHeap=0x310000) returned 1 [0240.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55724c8 | out: hHeap=0x310000) returned 1 [0240.380] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0240.380] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0240.380] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.380] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0240.964] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.965] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0240.978] CloseHandle (hObject=0x484) returned 1 [0240.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0240.978] RmStartSession () returned 0x0 [0240.998] RmRegisterResources () returned 0x0 [0240.998] RmGetList () returned 0x0 [0241.030] RmShutdown () returned 0x0 [0243.010] RmEndSession () returned 0x0 [0243.011] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52612c8) returned 1 [0243.011] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0243.011] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties", dwFileAttributes=0x20) returned 1 [0243.011] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0243.011] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0243.011] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3752) returned 1 [0243.011] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0243.012] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e2020 [0243.030] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0243.030] ReadFile (in: hFile=0x680, lpBuffer=0x49e2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x49e2040*, lpNumberOfBytesRead=0x33ef7d4*=0xea8, lpOverlapped=0x0) returned 1 [0243.067] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0243.067] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0243.067] WriteFile (in: hFile=0x680, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0243.067] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0243.067] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0243.068] WriteFile (in: hFile=0x680, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0243.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e2020 | out: hHeap=0x310000) returned 1 [0243.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0243.073] CloseHandle (hObject=0x680) returned 1 [0243.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0243.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc7d0 [0243.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0243.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcd90 [0243.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc7d0 | out: hHeap=0x310000) returned 1 [0243.073] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0243.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0243.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0243.074] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0243.074] GetLastError () returned 0x0 [0243.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x33ef610, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HTk", lpUsedDefaultChar=0x0) returned 3 [0243.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0243.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0243.074] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0243.074] WriteFile (in: hFile=0x680, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x33ef748*=0xe56, lpOverlapped=0x0) returned 1 [0243.075] CloseHandle (hObject=0x680) returned 1 [0243.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0243.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0243.076] CryptDestroyKey (hKey=0x52612c8) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef848 | out: hHeap=0x310000) returned 1 [0243.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571f28 | out: hHeap=0x310000) returned 1 [0243.076] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0243.076] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0243.076] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.076] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0243.283] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.283] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0243.283] CloseHandle (hObject=0x680) returned 1 [0243.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0243.283] RmStartSession () returned 0x0 [0243.285] RmRegisterResources () returned 0x0 [0243.289] RmGetList () returned 0x0 [0243.351] RmShutdown () returned 0x0 [0245.644] RmEndSession () returned 0x0 [0245.645] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260c88) returned 1 [0245.645] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0245.645] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar", dwFileAttributes=0x20) returned 1 [0245.645] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0245.645] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0245.645] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=280161) returned 1 [0245.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0245.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e5020 [0246.379] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0246.380] GetLastError () returned 0x0 [0246.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x33ef610, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qL4KWuTlRzCIw", lpUsedDefaultChar=0x0) returned 13 [0246.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0246.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0246.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0246.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0246.380] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0246.381] WriteFile (in: hFile=0x680, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x33ef748*=0xe60, lpOverlapped=0x0) returned 1 [0246.382] CloseHandle (hObject=0x680) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0246.382] CryptDestroyKey (hKey=0x5260c88) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a31a8 | out: hHeap=0x310000) returned 1 [0246.382] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53526a0 | out: hHeap=0x310000) returned 1 [0246.382] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0246.382] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0246.382] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.382] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0246.384] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.384] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0246.384] CloseHandle (hObject=0x680) returned 1 [0246.384] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0246.384] RmStartSession () returned 0x0 [0246.386] RmRegisterResources () returned 0x0 [0246.386] RmGetList () returned 0x0 [0247.405] RmShutdown () returned 0x0 [0248.539] RmEndSession () returned 0x0 [0248.745] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260f88) returned 1 [0248.745] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0248.746] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", dwFileAttributes=0x20) returned 1 [0248.746] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0248.746] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0248.746] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=13962) returned 1 [0248.746] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0248.746] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58ee020 [0249.009] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0249.009] GetLastError () returned 0x0 [0249.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0249.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0249.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0249.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0249.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0249.009] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0249.010] WriteFile (in: hFile=0x680, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x33ef748*=0xe69, lpOverlapped=0x0) returned 1 [0249.011] CloseHandle (hObject=0x680) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0249.011] CryptDestroyKey (hKey=0x5260f88) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efa40 | out: hHeap=0x310000) returned 1 [0249.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352510 | out: hHeap=0x310000) returned 1 [0249.011] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0249.011] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0249.012] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.012] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0249.071] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.071] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0249.071] CloseHandle (hObject=0x680) returned 1 [0249.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0249.071] RmStartSession () returned 0x0 [0249.472] RmRegisterResources () returned 0x0 [0249.472] RmGetList () returned 0x0 [0249.515] RmShutdown () returned 0x0 [0251.193] RmEndSession () returned 0x0 [0251.194] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52618c8) returned 1 [0251.194] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0251.194] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", dwFileAttributes=0x20) returned 1 [0251.195] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0251.195] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0251.195] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=116446) returned 1 [0251.195] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0251.195] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e3020 [0252.019] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0252.019] ReadFile (in: hFile=0x4ac, lpBuffer=0x49e3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x49e3040*, lpNumberOfBytesRead=0x33ef7d4*=0x1c6de, lpOverlapped=0x0) returned 1 [0252.021] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0252.021] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.021] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.021] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.021] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.022] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.022] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0252.023] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0252.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0252.024] WriteFile (in: hFile=0x4ac, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0252.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e3020 | out: hHeap=0x310000) returned 1 [0253.330] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d7a0c0 | out: hHeap=0x310000) returned 1 [0253.331] CloseHandle (hObject=0x4ac) returned 1 [0253.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0253.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0253.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0253.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0253.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0253.331] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0253.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391c48 [0253.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0253.332] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0253.332] GetLastError () returned 0x0 [0253.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x33ef610, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0253.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0253.332] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0253.332] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0253.333] WriteFile (in: hFile=0x4ac, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x33ef748*=0xe57, lpOverlapped=0x0) returned 1 [0253.334] CloseHandle (hObject=0x4ac) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0253.334] CryptDestroyKey (hKey=0x52618c8) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c28 | out: hHeap=0x310000) returned 1 [0253.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353550 | out: hHeap=0x310000) returned 1 [0253.334] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0253.335] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0253.335] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.335] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0253.336] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.336] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0253.336] CloseHandle (hObject=0x4ac) returned 1 [0253.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0253.336] RmStartSession () returned 0x0 [0253.339] RmRegisterResources () returned 0x0 [0253.340] RmGetList () returned 0x0 [0254.187] RmShutdown () returned 0x0 [0254.906] RmEndSession () returned 0x0 [0254.908] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261348) returned 1 [0254.908] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0254.908] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy", dwFileAttributes=0x20) returned 1 [0254.908] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0254.908] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0254.908] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=98) returned 1 [0254.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0254.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79b1020 [0255.698] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0255.698] ReadFile (in: hFile=0x4ac, lpBuffer=0x79b1040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x79b1040*, lpNumberOfBytesRead=0x33ef7d4*=0x62, lpOverlapped=0x0) returned 1 [0255.699] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0255.699] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0255.699] WriteFile (in: hFile=0x4ac, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0255.701] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0255.701] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0255.701] WriteFile (in: hFile=0x4ac, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0255.701] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79b1020 | out: hHeap=0x310000) returned 1 [0257.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5485030 | out: hHeap=0x310000) returned 1 [0257.599] CloseHandle (hObject=0x4ac) returned 1 [0257.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0257.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0257.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0257.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0257.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0257.599] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.bdcddcbaad"), dwFlags=0x1) returned 1 [0257.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0257.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a140 [0257.600] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0257.600] GetLastError () returned 0x0 [0257.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0257.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0257.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c548, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0257.601] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0257.601] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0257.601] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0257.601] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0257.601] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0257.602] WriteFile (in: hFile=0x4ac, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x33ef748*=0xe64, lpOverlapped=0x0) returned 1 [0257.602] CloseHandle (hObject=0x4ac) returned 1 [0257.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0257.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0257.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a140 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0257.603] CryptDestroyKey (hKey=0x5261348) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2e78 | out: hHeap=0x310000) returned 1 [0257.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353690 | out: hHeap=0x310000) returned 1 [0257.603] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0257.603] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0257.603] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.603] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0257.605] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.605] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0257.605] CloseHandle (hObject=0x4ac) returned 1 [0257.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f06bd0 [0257.605] RmStartSession () returned 0x0 [0257.607] RmRegisterResources () returned 0x0 [0257.608] RmGetList () returned 0x0 [0258.165] RmShutdown () returned 0x0 [0260.696] RmEndSession () returned 0x0 [0260.890] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52618c8) returned 1 [0260.890] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0260.890] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0260.890] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0260.890] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0260.890] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=1533) returned 1 [0260.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0260.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c29020 [0261.543] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0261.543] GetLastError () returned 0x0 [0261.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0261.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0261.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c480, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0261.544] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6107570 | out: hHeap=0x310000) returned 1 [0261.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0261.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54ee468 [0261.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0261.544] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0261.545] WriteFile (in: hFile=0x4ac, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x33ef748*=0xe71, lpOverlapped=0x0) returned 1 [0261.545] CloseHandle (hObject=0x4ac) returned 1 [0261.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04878 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539ec80 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05270 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0261.546] CryptDestroyKey (hKey=0x52618c8) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f06bd0 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9f40 | out: hHeap=0x310000) returned 1 [0261.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351e30 | out: hHeap=0x310000) returned 1 [0261.546] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0261.546] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0261.546] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.546] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0261.548] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.548] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0261.548] CloseHandle (hObject=0x4ac) returned 1 [0261.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f04878 [0261.548] RmStartSession () returned 0x0 [0261.631] RmRegisterResources () returned 0x0 [0261.632] RmGetList () returned 0x0 [0261.836] RmShutdown () returned 0x0 [0263.439] RmEndSession () returned 0x0 [0263.440] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261ac8) returned 1 [0263.440] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0263.440] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0263.440] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0263.440] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0263.441] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=343329) returned 1 [0263.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0263.441] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ef020 [0264.968] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0264.968] GetLastError () returned 0x0 [0264.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cA59qhRcQfh", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0264.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cA59qhRcQfh", cchWideChar=11, lpMultiByteStr=0x33ef610, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cA59qhRcQfh", lpUsedDefaultChar=0x0) returned 11 [0264.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0264.969] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0264.969] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0264.969] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0264.970] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x33ef748*=0xe5e, lpOverlapped=0x0) returned 1 [0264.971] CloseHandle (hObject=0x6a8) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f056f8 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5398e88 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0ab40 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0264.975] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04878 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53489a8 | out: hHeap=0x310000) returned 1 [0264.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351c50 | out: hHeap=0x310000) returned 1 [0264.976] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0264.976] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0264.976] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0264.976] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0264.987] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0264.987] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0264.988] CloseHandle (hObject=0x6a8) returned 1 [0264.988] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f056f8 [0264.988] RmStartSession () returned 0x0 [0265.022] RmRegisterResources () returned 0x0 [0265.025] RmGetList () returned 0x0 [0265.710] RmShutdown () returned 0x0 [0265.904] RmEndSession () returned 0x0 [0265.905] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261488) returned 1 [0265.906] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0265.906] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0265.906] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0265.906] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0265.906] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=3754) returned 1 [0265.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0265.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c24020 [0267.142] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0267.143] GetLastError () returned 0x0 [0267.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0267.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0267.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x38c480, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pvosW60j6t7if2aYH", lpUsedDefaultChar=0x0) returned 17 [0267.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0267.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0267.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0267.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0267.143] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0267.144] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x33ef748*=0xe64, lpOverlapped=0x0) returned 1 [0267.144] CloseHandle (hObject=0x6a8) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539dd00 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0267.145] CryptDestroyKey (hKey=0x5261488) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f056f8 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5347958 | out: hHeap=0x310000) returned 1 [0267.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19420 | out: hHeap=0x310000) returned 1 [0267.145] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0267.145] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0267.145] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.145] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0267.165] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.165] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0267.165] CloseHandle (hObject=0x6a8) returned 1 [0267.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0267.165] RmStartSession () returned 0x0 [0267.167] RmRegisterResources () returned 0x0 [0267.168] RmGetList () returned 0x0 [0267.201] RmShutdown () returned 0x0 [0267.976] RmEndSession () returned 0x0 [0267.977] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52619c8) returned 1 [0267.977] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0267.977] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x220) returned 1 [0267.977] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0267.977] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0267.978] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=6684) returned 1 [0267.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0267.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79ff020 [0268.028] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0268.028] GetLastError () returned 0x0 [0268.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0268.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0268.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x38c520, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3PiqIn2wVpHXSiax4SL", lpUsedDefaultChar=0x0) returned 20 [0268.029] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0268.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0268.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0268.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0268.029] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0268.030] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x33ef748*=0xe67, lpOverlapped=0x0) returned 1 [0268.031] CloseHandle (hObject=0x6a8) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dba28 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0268.031] CryptDestroyKey (hKey=0x52619c8) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570508 | out: hHeap=0x310000) returned 1 [0268.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5d50 | out: hHeap=0x310000) returned 1 [0268.031] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0268.031] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0268.031] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.031] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0268.032] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.032] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0268.032] CloseHandle (hObject=0x6a8) returned 1 [0268.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0268.033] RmStartSession () returned 0x0 [0268.035] RmRegisterResources () returned 0x0 [0268.035] RmGetList () returned 0x0 [0269.261] RmShutdown () returned 0x0 [0270.049] RmEndSession () returned 0x0 [0270.050] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261548) returned 1 [0270.050] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0270.050] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF", dwFileAttributes=0x220) returned 1 [0270.051] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0270.051] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0270.051] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=502) returned 1 [0270.051] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0270.051] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621d020 [0270.081] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0270.082] GetLastError () returned 0x0 [0270.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0270.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0270.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c1d8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0270.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89960 | out: hHeap=0x310000) returned 1 [0270.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0270.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0270.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0270.082] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0270.083] WriteFile (in: hFile=0x6a8, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x33ef748*=0xe6e, lpOverlapped=0x0) returned 1 [0270.084] CloseHandle (hObject=0x6a8) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0270.084] CryptDestroyKey (hKey=0x5261548) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a54d0 | out: hHeap=0x310000) returned 1 [0270.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e33b0 | out: hHeap=0x310000) returned 1 [0270.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0270.084] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0270.085] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.085] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0270.396] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.396] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0270.396] CloseHandle (hObject=0x6a8) returned 1 [0270.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0270.396] RmStartSession () returned 0x0 [0270.397] RmRegisterResources () returned 0x0 [0270.398] RmGetList () returned 0x0 [0270.488] RmShutdown () returned 0x0 [0272.381] RmEndSession () returned 0x0 [0272.382] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260d88) returned 1 [0272.383] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0272.383] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF", dwFileAttributes=0x220) returned 1 [0272.383] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0272.383] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0272.383] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=5030) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0272.384] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6210020 [0272.410] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0272.410] GetLastError () returned 0x0 [0272.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0272.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x33ef610, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bY", lpUsedDefaultChar=0x0) returned 2 [0272.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0272.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0272.410] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0272.411] WriteFile (in: hFile=0x6a8, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x33ef748*=0xe55, lpOverlapped=0x0) returned 1 [0272.412] CloseHandle (hObject=0x6a8) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53eaf80 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0272.412] CryptDestroyKey (hKey=0x5260d88) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5568 | out: hHeap=0x310000) returned 1 [0272.412] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3400 | out: hHeap=0x310000) returned 1 [0272.412] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0272.412] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0272.413] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.413] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0272.829] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.829] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0272.829] CloseHandle (hObject=0x6a8) returned 1 [0272.829] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4120 [0272.829] RmStartSession () returned 0x0 [0272.930] RmRegisterResources () returned 0x0 [0272.931] RmGetList () returned 0x0 [0273.159] RmShutdown () returned 0x0 [0273.566] RmEndSession () returned 0x0 [0273.567] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261788) returned 1 [0273.567] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0273.567] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF", dwFileAttributes=0x220) returned 1 [0273.567] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0273.568] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0273.568] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=4390) returned 1 [0273.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0273.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d2020 [0273.880] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0273.880] GetLastError () returned 0x0 [0273.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0273.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x33ef610, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JI3sLVWO", lpUsedDefaultChar=0x0) returned 8 [0273.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0273.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0273.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0273.880] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0273.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x33ef748*=0xe5b, lpOverlapped=0x0) returned 1 [0273.882] CloseHandle (hObject=0x6a8) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cb6e8 | out: hHeap=0x310000) returned 1 [0273.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0273.883] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0273.883] CryptDestroyKey (hKey=0x5261788) returned 1 [0273.883] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4120 | out: hHeap=0x310000) returned 1 [0273.883] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5860 | out: hHeap=0x310000) returned 1 [0273.883] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3540 | out: hHeap=0x310000) returned 1 [0273.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0273.883] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0273.883] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.883] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0273.916] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.916] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0273.916] CloseHandle (hObject=0x6a8) returned 1 [0273.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b41b8 [0273.916] RmStartSession () returned 0x0 [0273.918] RmRegisterResources () returned 0x0 [0273.918] RmGetList () returned 0x0 [0276.038] RmShutdown () returned 0x0 [0277.837] RmEndSession () returned 0x0 [0277.837] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x52619c8) returned 1 [0277.837] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0277.838] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF", dwFileAttributes=0x220) returned 1 [0277.838] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0277.838] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0277.838] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=5684) returned 1 [0277.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0277.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d5020 [0278.215] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0278.215] ReadFile (in: hFile=0x6a8, lpBuffer=0x78d5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x78d5040*, lpNumberOfBytesRead=0x33ef7d4*=0x1634, lpOverlapped=0x0) returned 1 [0278.216] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0278.216] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0278.216] WriteFile (in: hFile=0x6a8, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0278.216] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0278.216] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0278.216] WriteFile (in: hFile=0x6a8, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0278.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x78d5020 | out: hHeap=0x310000) returned 1 [0278.675] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0278.675] CloseHandle (hObject=0x6a8) returned 1 [0278.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0278.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0278.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0278.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0e48 [0278.675] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0278.676] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0278.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0278.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0278.677] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0278.677] GetLastError () returned 0x0 [0278.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0278.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c4d0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0278.678] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0278.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0278.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0278.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0278.678] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0278.679] WriteFile (in: hFile=0x6a8, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x33ef748*=0xe68, lpOverlapped=0x0) returned 1 [0278.680] CloseHandle (hObject=0x6a8) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0e48 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0278.680] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0278.680] CryptDestroyKey (hKey=0x52619c8) returned 1 [0278.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0278.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5140 | out: hHeap=0x310000) returned 1 [0278.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3180 | out: hHeap=0x310000) returned 1 [0278.681] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0278.681] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0278.681] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.681] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0278.685] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.686] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0278.686] CloseHandle (hObject=0x6a8) returned 1 [0278.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b41b8 [0278.686] RmStartSession () returned 0x0 [0278.688] RmRegisterResources () returned 0x0 [0278.689] RmGetList () returned 0x0 [0279.866] RmShutdown () returned 0x0 [0281.628] RmEndSession () returned 0x0 [0281.629] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x35dd48) returned 1 [0281.629] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0281.629] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF", dwFileAttributes=0x220) returned 1 [0281.629] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0281.630] CryptEncrypt (in: hKey=0x35dd48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0281.630] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=6636) returned 1 [0281.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0281.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7a2e020 [0282.241] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0282.241] ReadFile (in: hFile=0x6a8, lpBuffer=0x7a2e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x7a2e040*, lpNumberOfBytesRead=0x33ef7d4*=0x19ec, lpOverlapped=0x0) returned 1 [0282.243] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0282.243] CryptEncrypt (in: hKey=0x35dd48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5281b60*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5281b60*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0282.243] WriteFile (in: hFile=0x6a8, lpBuffer=0x5281b60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5281b60*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0282.243] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0282.243] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0282.244] WriteFile (in: hFile=0x6a8, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0282.244] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7a2e020 | out: hHeap=0x310000) returned 1 [0282.321] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5281b40 | out: hHeap=0x310000) returned 1 [0282.321] CloseHandle (hObject=0x6a8) returned 1 [0282.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0282.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0282.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0282.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0282.322] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0282.322] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0282.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0282.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0282.323] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0282.323] GetLastError () returned 0x0 [0282.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0282.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x33ef610, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fl", lpUsedDefaultChar=0x0) returned 2 [0282.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0282.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0282.323] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0282.324] WriteFile (in: hFile=0x6a8, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x33ef748*=0xe55, lpOverlapped=0x0) returned 1 [0282.325] CloseHandle (hObject=0x6a8) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0282.325] CryptDestroyKey (hKey=0x35dd48) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571938 | out: hHeap=0x310000) returned 1 [0282.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1a60 | out: hHeap=0x310000) returned 1 [0282.326] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0282.326] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0282.326] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.326] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0282.338] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.338] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0282.338] CloseHandle (hObject=0x6a8) returned 1 [0282.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0282.338] RmStartSession () returned 0x0 [0282.340] RmRegisterResources () returned 0x0 [0282.345] RmGetList () returned 0x0 [0284.380] RmShutdown () returned 0x0 [0287.662] RmEndSession () returned 0x0 [0287.663] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5261008) returned 1 [0287.663] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0287.663] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF", dwFileAttributes=0x220) returned 1 [0287.663] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0287.663] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0287.663] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=26886) returned 1 [0287.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0287.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589a020 [0287.983] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0287.983] ReadFile (in: hFile=0x6a8, lpBuffer=0x589a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x589a040*, lpNumberOfBytesRead=0x33ef7d4*=0x6906, lpOverlapped=0x0) returned 1 [0287.985] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0287.985] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0287.985] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0287.985] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0287.985] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0287.985] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0287.985] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0287.986] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0287.986] WriteFile (in: hFile=0x6a8, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0287.986] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0287.986] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0287.986] WriteFile (in: hFile=0x6a8, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0287.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589a020 | out: hHeap=0x310000) returned 1 [0288.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0288.086] CloseHandle (hObject=0x6a8) returned 1 [0288.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0288.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4938 [0288.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0288.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3740 [0288.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4938 | out: hHeap=0x310000) returned 1 [0288.087] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0288.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0288.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0288.088] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0288.088] GetLastError () returned 0x0 [0288.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0288.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0288.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x38c1d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n02uzHYCkn2cuVUIt7q96r", lpUsedDefaultChar=0x0) returned 22 [0288.088] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0288.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0288.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0288.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0288.088] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0288.089] WriteFile (in: hFile=0x6a8, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x33ef748*=0xe69, lpOverlapped=0x0) returned 1 [0288.089] CloseHandle (hObject=0x6a8) returned 1 [0288.089] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3740 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0288.090] CryptDestroyKey (hKey=0x5261008) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94b90 | out: hHeap=0x310000) returned 1 [0288.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2b90 | out: hHeap=0x310000) returned 1 [0288.090] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0288.090] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0288.090] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.090] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0288.133] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.133] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0288.134] CloseHandle (hObject=0x6a8) returned 1 [0288.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0288.134] RmStartSession () returned 0x0 [0288.135] RmRegisterResources () returned 0x0 [0288.139] RmGetList () returned 0x0 [0288.624] RmShutdown () returned 0x0 [0291.910] RmEndSession () returned 0x0 [0291.911] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x35d848) returned 1 [0291.911] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0291.911] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF", dwFileAttributes=0x220) returned 1 [0291.911] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0291.911] CryptEncrypt (in: hKey=0x35d848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0291.911] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=8772) returned 1 [0291.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0291.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65cc020 [0292.352] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0292.352] ReadFile (in: hFile=0x6a8, lpBuffer=0x65cc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x65cc040*, lpNumberOfBytesRead=0x33ef7d4*=0x2244, lpOverlapped=0x0) returned 1 [0292.355] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0292.355] CryptEncrypt (in: hKey=0x35d848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0292.355] WriteFile (in: hFile=0x6a8, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0292.356] CryptEncrypt (in: hKey=0x35d848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0292.356] WriteFile (in: hFile=0x6a8, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0292.356] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0292.356] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0292.356] WriteFile (in: hFile=0x6a8, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0292.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65cc020 | out: hHeap=0x310000) returned 1 [0292.421] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0292.421] CloseHandle (hObject=0x6a8) returned 1 [0292.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0292.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0292.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0292.421] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0292.421] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0292.421] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4e48 [0292.422] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0292.422] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0292.423] GetLastError () returned 0x0 [0292.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x33ef610, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0292.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.423] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0292.424] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x33ef748*=0xe56, lpOverlapped=0x0) returned 1 [0292.425] CloseHandle (hObject=0x6a8) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4e48 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0292.425] CryptDestroyKey (hKey=0x35d848) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95cc8 | out: hHeap=0x310000) returned 1 [0292.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2c30 | out: hHeap=0x310000) returned 1 [0292.425] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0292.425] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0292.425] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.426] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0292.427] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.427] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0292.427] CloseHandle (hObject=0x6a8) returned 1 [0292.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5730 [0292.427] RmStartSession () returned 0x0 [0293.164] RmRegisterResources () returned 0x0 [0293.165] RmGetList () returned 0x0 [0293.395] RmShutdown () returned 0x0 [0294.842] RmEndSession () returned 0x0 [0294.843] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x33ef8d4 | out: phKey=0x33ef8d4*=0x5260ec8) returned 1 [0294.843] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0294.843] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF", dwFileAttributes=0x220) returned 1 [0294.843] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0294.844] CryptEncrypt (in: hKey=0x5260ec8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x33ef734*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x33ef734*=0x2000) returned 1 [0294.844] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x33ef7cc | out: lpFileSize=0x33ef7cc*=12482) returned 1 [0294.844] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0294.844] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f6020 [0294.873] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0294.873] ReadFile (in: hFile=0x558, lpBuffer=0x56f6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x56f6040*, lpNumberOfBytesRead=0x33ef7d4*=0x30c2, lpOverlapped=0x0) returned 1 [0294.922] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7bc | out: lpNewFilePointer=0x0) returned 1 [0294.922] CryptEncrypt (in: hKey=0x5260ec8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0294.922] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0294.925] CryptEncrypt (in: hKey=0x5260ec8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x33ef748*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x33ef748*=0x2000) returned 1 [0294.925] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x33ef7d8*=0x2000, lpOverlapped=0x0) returned 1 [0294.925] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ef7c4 | out: lpNewFilePointer=0x0) returned 1 [0294.925] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x33ef7d8*=0x200, lpOverlapped=0x0) returned 1 [0294.925] WriteFile (in: hFile=0x558, lpBuffer=0x33ef774*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x33ef7d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef774*, lpNumberOfBytesWritten=0x33ef7d8*=0x18, lpOverlapped=0x0) returned 1 [0294.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f6020 | out: hHeap=0x310000) returned 1 [0294.930] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0294.930] CloseHandle (hObject=0x558) returned 1 [0294.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0294.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4fb0 [0294.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95640 [0294.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf3b0 [0294.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4fb0 | out: hHeap=0x310000) returned 1 [0294.931] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0294.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95a68 [0294.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0294.932] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x33ef5a8 | out: lpSystemTimeAsFileTime=0x33ef5a8) [0294.932] GetLastError () returned 0x0 [0294.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0294.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x33ef610, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrHQog3L8507y", lpUsedDefaultChar=0x0) returned 13 [0294.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0294.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0294.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0294.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0294.933] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0294.934] WriteFile (in: hFile=0x558, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x33ef748, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x33ef748*=0xe60, lpOverlapped=0x0) returned 1 [0294.934] CloseHandle (hObject=0x558) returned 1 [0294.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95a68 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95640 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0294.935] CryptDestroyKey (hKey=0x5260ec8) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5730 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306618 | out: hHeap=0x310000) returned 1 [0294.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609f48 | out: hHeap=0x310000) returned 1 [0294.935] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x33ef908, lpCompletionKey=0x33ef90c, lpOverlapped=0x33ef904) returned 1 [0294.935] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0294.935] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0294.935] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7d4*=0x18, lpOverlapped=0x0) returned 1 [0295.126] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33ef7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.126] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x33ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x33ef7c8*=0x18, lpOverlapped=0x0) returned 1 [0295.126] CloseHandle (hObject=0x558) returned 1 [0295.126] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c955a8 [0295.127] RmStartSession () returned 0x0 [0295.164] RmRegisterResources () returned 0x0 [0295.165] RmGetList () returned 0x0 [0296.114] RmShutdown () Thread: id = 10 os_tid = 0x10b8 [0068.589] GetLastError () returned 0x57 [0068.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x34b168 [0068.589] SetLastError (dwErrCode=0x57) [0068.589] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0077.170] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0094.696] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0106.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0126.620] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0129.881] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0130.914] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0134.188] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0134.189] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.190] ReadFile (in: hFile=0x4dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0134.190] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.190] ReadFile (in: hFile=0x4dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0134.191] CloseHandle (hObject=0x4dc) returned 1 [0134.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0134.191] RmStartSession () returned 0x0 [0134.375] RmRegisterResources () returned 0x0 [0134.393] RmGetList () returned 0x0 [0135.054] RmShutdown () returned 0x0 [0137.603] RmEndSession () returned 0x0 [0137.730] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x52614c8) returned 1 [0137.730] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0137.730] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd", dwFileAttributes=0x20) returned 1 [0137.730] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0137.731] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0137.731] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=74) returned 1 [0137.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x53577b0 [0137.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57f5020 [0137.749] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0137.749] ReadFile (in: hFile=0x508, lpBuffer=0x57f5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x57f5040*, lpNumberOfBytesRead=0x352f924*=0x4a, lpOverlapped=0x0) returned 1 [0137.750] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0137.751] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53577c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x53577c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0137.751] WriteFile (in: hFile=0x508, lpBuffer=0x53577c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x53577c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0137.788] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0137.788] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0137.788] WriteFile (in: hFile=0x508, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0137.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57f5020 | out: hHeap=0x310000) returned 1 [0137.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53577b0 | out: hHeap=0x310000) returned 1 [0137.793] CloseHandle (hObject=0x508) returned 1 [0137.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0137.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060d18 [0137.794] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0137.795] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060cb0 [0137.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060d18 | out: hHeap=0x310000) returned 1 [0137.795] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\\\$GetCurrent\\SafeOS\\preoobe.cmd.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.bdcddcbaad"), dwFlags=0x1) returned 1 [0137.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0137.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b848 [0137.957] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] GetLastError () returned 0x0 [0137.957] SetLastError (dwErrCode=0x0) [0137.957] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] GetLastError () returned 0x0 [0137.958] SetLastError (dwErrCode=0x0) [0137.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0137.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0137.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x352f760, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sZcY8NRWe7TT", lpUsedDefaultChar=0x0) returned 12 [0137.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0137.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5a50078 [0137.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0137.958] CreateFileW (lpFileName="C:\\\\$GetCurrent\\SafeOS\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\safeos\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0137.959] WriteFile (in: hFile=0x508, lpBuffer=0x5a50078*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x5a50078*, lpNumberOfBytesWritten=0x352f898*=0xe5f, lpOverlapped=0x0) returned 1 [0137.960] CloseHandle (hObject=0x508) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5a50078 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b848 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060cb0 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0137.961] CryptDestroyKey (hKey=0x52614c8) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399350 | out: hHeap=0x310000) returned 1 [0137.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365bd8 | out: hHeap=0x310000) returned 1 [0137.961] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0137.961] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0138.001] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.001] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0138.002] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.002] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0138.002] CloseHandle (hObject=0x660) returned 1 [0138.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0138.002] RmStartSession () returned 0x0 [0138.007] RmRegisterResources () returned 0x0 [0138.007] RmGetList () returned 0x0 [0138.404] RmShutdown () returned 0x0 [0140.667] RmEndSession () returned 0x0 [0140.669] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x35da08) returned 1 [0140.669] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0140.669] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x80) returned 1 [0140.669] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0140.670] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0140.670] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=8876) returned 1 [0140.670] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bba578 [0140.670] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dc9020 [0140.886] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0140.886] ReadFile (in: hFile=0x660, lpBuffer=0x4dc9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x4dc9040*, lpNumberOfBytesRead=0x352f924*=0x22ac, lpOverlapped=0x0) returned 1 [0140.888] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0140.888] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x352f898*=0x2000) returned 1 [0140.888] WriteFile (in: hFile=0x660, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0140.888] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x352f898*=0x2000) returned 1 [0140.888] WriteFile (in: hFile=0x660, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0140.889] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0140.889] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0140.889] WriteFile (in: hFile=0x660, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0140.889] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dc9020 | out: hHeap=0x310000) returned 1 [0140.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba578 | out: hHeap=0x310000) returned 1 [0140.969] CloseHandle (hObject=0x660) returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0140.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0140.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0140.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0140.971] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0140.971] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1032\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0140.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0140.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0140.974] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0140.974] GetLastError () returned 0x0 [0140.974] SetLastError (dwErrCode=0x0) [0140.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0140.974] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.975] SetLastError (dwErrCode=0x0) [0140.975] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0140.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] GetLastError () returned 0x0 [0140.976] SetLastError (dwErrCode=0x0) [0140.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0140.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0140.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RvQ78znxAxbgIhBd7BJgQH", cchWideChar=22, lpMultiByteStr=0x38c1d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RvQ78znxAxbgIhBd7BJgQH", lpUsedDefaultChar=0x0) returned 22 [0140.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0140.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0140.977] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5061058 [0140.977] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0140.977] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0140.977] WriteFile (in: hFile=0x660, lpBuffer=0x5061058*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x5061058*, lpNumberOfBytesWritten=0x352f898*=0xe69, lpOverlapped=0x0) returned 1 [0140.978] CloseHandle (hObject=0x660) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5061058 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0140.979] CryptDestroyKey (hKey=0x35da08) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0140.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18de0 | out: hHeap=0x310000) returned 1 [0140.979] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0140.979] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0140.980] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.980] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0141.026] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.026] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0141.026] CloseHandle (hObject=0x660) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0141.026] RmStartSession () returned 0x0 [0141.029] RmRegisterResources () returned 0x0 [0141.033] RmGetList () returned 0x0 [0141.368] RmShutdown () returned 0x0 [0144.281] RmEndSession () returned 0x0 [0144.282] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261a08) returned 1 [0144.282] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0144.282] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x80) returned 1 [0144.282] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0144.282] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0144.282] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3526) returned 1 [0144.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5df4020 [0144.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6838020 [0144.552] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0144.553] ReadFile (in: hFile=0x660, lpBuffer=0x6838040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x6838040*, lpNumberOfBytesRead=0x352f924*=0xdc6, lpOverlapped=0x0) returned 1 [0144.554] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0144.554] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4040*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4040*, pdwDataLen=0x352f898*=0x2000) returned 1 [0144.554] WriteFile (in: hFile=0x660, lpBuffer=0x5df4040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5df4040*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0144.554] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0144.554] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0144.555] WriteFile (in: hFile=0x660, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0144.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6838020 | out: hHeap=0x310000) returned 1 [0144.714] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5df4020 | out: hHeap=0x310000) returned 1 [0144.714] CloseHandle (hObject=0x660) returned 1 [0144.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0144.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0144.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0144.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0144.716] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0144.716] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1036\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0144.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0144.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0144.717] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0144.717] GetLastError () returned 0x0 [0144.717] SetLastError (dwErrCode=0x0) [0144.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0144.717] GetLastError () returned 0x0 [0144.717] SetLastError (dwErrCode=0x0) [0144.717] GetLastError () returned 0x0 [0144.717] SetLastError (dwErrCode=0x0) [0144.717] GetLastError () returned 0x0 [0144.717] SetLastError (dwErrCode=0x0) [0144.717] GetLastError () returned 0x0 [0144.717] SetLastError (dwErrCode=0x0) [0144.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0144.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0144.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x352f760, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NQM", lpUsedDefaultChar=0x0) returned 3 [0144.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0144.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5365040 [0144.718] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1036\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0144.718] WriteFile (in: hFile=0x660, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x352f898*=0xe56, lpOverlapped=0x0) returned 1 [0144.720] CloseHandle (hObject=0x660) returned 1 [0144.720] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5365040 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0144.721] CryptDestroyKey (hKey=0x5261a08) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399508 | out: hHeap=0x310000) returned 1 [0144.721] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c190b0 | out: hHeap=0x310000) returned 1 [0144.721] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0144.721] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0144.721] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.721] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0144.736] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.736] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0144.736] CloseHandle (hObject=0x660) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0144.736] RmStartSession () returned 0x0 [0144.740] RmRegisterResources () returned 0x0 [0144.743] RmGetList () returned 0x0 [0144.901] RmShutdown () returned 0x0 [0151.623] RmEndSession () returned 0x0 [0151.624] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261a88) returned 1 [0151.624] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0151.624] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x80) returned 1 [0151.624] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0151.624] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0151.624] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3046) returned 1 [0151.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5426340 [0151.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x672e020 [0151.915] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0151.915] ReadFile (in: hFile=0x660, lpBuffer=0x672e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x672e040*, lpNumberOfBytesRead=0x352f924*=0xbe6, lpOverlapped=0x0) returned 1 [0151.917] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0151.917] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5426360*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5426360*, pdwDataLen=0x352f898*=0x2000) returned 1 [0151.917] WriteFile (in: hFile=0x660, lpBuffer=0x5426360*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5426360*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0151.917] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0151.917] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0151.917] WriteFile (in: hFile=0x660, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0151.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x672e020 | out: hHeap=0x310000) returned 1 [0153.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5426340 | out: hHeap=0x310000) returned 1 [0153.272] CloseHandle (hObject=0x660) returned 1 [0153.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0153.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0153.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398ed8 [0153.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0153.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0153.274] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1044\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0153.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0153.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0153.275] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.275] GetLastError () returned 0x0 [0153.275] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7a0 [0153.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] GetLastError () returned 0x0 [0153.276] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5351bb0 [0153.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] GetLastError () returned 0x0 [0153.277] SetLastError (dwErrCode=0x0) [0153.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0153.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0153.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0153.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", cchWideChar=29, lpMultiByteStr=0x38c3e0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iPCQ7sGelK7Uipq2gzp4dHTCV0nC5", lpUsedDefaultChar=0x0) returned 29 [0153.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351bb0 | out: hHeap=0x310000) returned 1 [0153.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0153.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5061058 [0153.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0153.278] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0153.279] WriteFile (in: hFile=0x660, lpBuffer=0x5061058*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x5061058*, lpNumberOfBytesWritten=0x352f898*=0xe70, lpOverlapped=0x0) returned 1 [0153.279] CloseHandle (hObject=0x660) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5061058 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0153.280] CryptDestroyKey (hKey=0x5261a88) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399718 | out: hHeap=0x310000) returned 1 [0153.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c193d0 | out: hHeap=0x310000) returned 1 [0153.280] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0153.280] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0153.280] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.281] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0153.345] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.345] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0153.346] CloseHandle (hObject=0x660) returned 1 [0153.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0153.346] RmStartSession () returned 0x0 [0153.348] RmRegisterResources () returned 0x0 [0153.352] RmGetList () returned 0x0 [0153.901] RmShutdown () returned 0x0 [0158.084] RmEndSession () returned 0x0 [0158.085] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261988) returned 1 [0158.085] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0158.086] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico", dwFileAttributes=0x80) returned 1 [0158.086] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0158.086] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0158.086] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=10134) returned 1 [0158.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8568 [0158.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64be020 [0158.579] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0158.579] ReadFile (in: hFile=0x660, lpBuffer=0x64be040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x64be040*, lpNumberOfBytesRead=0x352f924*=0x2796, lpOverlapped=0x0) returned 1 [0158.581] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0158.581] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x352f898*=0x2000) returned 1 [0158.581] WriteFile (in: hFile=0x660, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0158.581] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x352f898*=0x2000) returned 1 [0158.581] WriteFile (in: hFile=0x660, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0158.582] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0158.582] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0158.582] WriteFile (in: hFile=0x660, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0158.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64be020 | out: hHeap=0x310000) returned 1 [0161.756] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8568 | out: hHeap=0x310000) returned 1 [0161.757] CloseHandle (hObject=0x660) returned 1 [0161.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0161.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0161.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0161.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0161.759] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0161.759] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0161.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0161.760] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0161.760] GetLastError () returned 0x0 [0161.760] SetLastError (dwErrCode=0x0) [0161.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a42a8 [0161.760] GetLastError () returned 0x0 [0161.760] SetLastError (dwErrCode=0x0) [0161.760] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.761] SetLastError (dwErrCode=0x0) [0161.761] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0161.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5296008 [0161.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] GetLastError () returned 0x0 [0161.762] SetLastError (dwErrCode=0x0) [0161.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a42a8 | out: hHeap=0x310000) returned 1 [0161.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q1AfbAKuprW61B5MjEbcongvGb", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0161.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0161.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q1AfbAKuprW61B5MjEbcongvGb", cchWideChar=26, lpMultiByteStr=0x38c188, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q1AfbAKuprW61B5MjEbcongvGb", lpUsedDefaultChar=0x0) returned 26 [0161.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5296008 | out: hHeap=0x310000) returned 1 [0161.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0161.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0161.763] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0161.763] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0161.764] WriteFile (in: hFile=0x660, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x352f898*=0xe6d, lpOverlapped=0x0) returned 1 [0161.765] CloseHandle (hObject=0x660) returned 1 [0161.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0161.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0161.766] CryptDestroyKey (hKey=0x5261988) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060f20 | out: hHeap=0x310000) returned 1 [0161.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5b70 | out: hHeap=0x310000) returned 1 [0161.766] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0161.766] CreateFileW (lpFileName="C:\\\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0161.766] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.766] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0162.136] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.136] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0162.136] CloseHandle (hObject=0x660) returned 1 [0162.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0162.136] RmStartSession () returned 0x0 [0164.635] RmRegisterResources () returned 0x0 [0164.640] RmGetList () returned 0x0 [0166.993] RmShutdown () returned 0x0 [0168.844] RmEndSession () returned 0x0 [0168.845] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261308) returned 1 [0168.845] GetFileAttributesW (lpFileName="C:\\\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0168.845] SetFileAttributesW (lpFileName="C:\\\\Logs\\Key Management Service.evtx", dwFileAttributes=0x20) returned 1 [0168.845] CreateFileW (lpFileName="C:\\\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0168.845] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0168.845] GetFileSizeEx (in: hFile=0x5a8, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0168.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0168.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58cb020 [0169.575] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0169.575] ReadFile (in: hFile=0x5a8, lpBuffer=0x58cb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x58cb040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0169.578] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0169.578] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.578] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.578] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.578] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.579] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.579] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.579] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.579] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.579] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.579] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.579] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.579] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.579] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.580] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.580] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.580] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.580] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0169.580] WriteFile (in: hFile=0x5a8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0169.581] WriteFile (in: hFile=0x5a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0169.581] WriteFile (in: hFile=0x5a8, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0169.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58cb020 | out: hHeap=0x310000) returned 1 [0169.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0169.588] CloseHandle (hObject=0x5a8) returned 1 [0170.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0170.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0170.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0170.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0170.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0170.521] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="C:\\\\Logs\\Key Management Service.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\key management service.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0170.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399718 [0170.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0170.522] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.522] GetLastError () returned 0x0 [0170.522] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb58 [0170.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] GetLastError () returned 0x0 [0170.523] SetLastError (dwErrCode=0x0) [0170.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0170.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HU02lG8NYmCdx6C8bSx2", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0170.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0170.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HU02lG8NYmCdx6C8bSx2", cchWideChar=20, lpMultiByteStr=0x38c520, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HU02lG8NYmCdx6C8bSx2", lpUsedDefaultChar=0x0) returned 20 [0170.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0170.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0170.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0170.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0170.524] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0170.525] WriteFile (in: hFile=0x5a8, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x352f898*=0xe67, lpOverlapped=0x0) returned 1 [0170.526] CloseHandle (hObject=0x5a8) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399718 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0170.527] CryptDestroyKey (hKey=0x5261308) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399140 | out: hHeap=0x310000) returned 1 [0170.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3655e8 | out: hHeap=0x310000) returned 1 [0170.527] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0170.527] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0170.527] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.528] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0170.529] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.529] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0170.529] CloseHandle (hObject=0x5a8) returned 1 [0170.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bbd3a8 [0170.529] RmStartSession () returned 0x0 [0170.531] RmRegisterResources () returned 0x0 [0170.534] RmGetList () returned 0x0 [0171.151] RmShutdown () returned 0x0 [0171.747] RmEndSession () returned 0x0 [0171.767] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261308) returned 1 [0171.767] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0171.767] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0171.768] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0171.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0171.768] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0171.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x533d0a8 [0171.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6c7e020 [0171.987] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0171.987] ReadFile (in: hFile=0x698, lpBuffer=0x6c7e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x6c7e040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0171.990] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.990] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.990] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.990] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.990] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.990] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.990] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.991] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.991] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.991] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0171.991] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0171.991] WriteFile (in: hFile=0x698, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0171.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c7e020 | out: hHeap=0x310000) returned 1 [0172.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533d0a8 | out: hHeap=0x310000) returned 1 [0172.091] CloseHandle (hObject=0x698) returned 1 [0172.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0172.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5334018 [0172.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bba6f0 [0172.093] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x5333608 [0172.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5334018 | out: hHeap=0x310000) returned 1 [0172.094] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0172.094] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x4bbad80 [0172.094] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0172.094] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0172.094] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3de0 [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.095] SetLastError (dwErrCode=0x0) [0172.095] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0172.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0172.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.096] SetLastError (dwErrCode=0x0) [0172.096] GetLastError () returned 0x0 [0172.097] SetLastError (dwErrCode=0x0) [0172.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3de0 | out: hHeap=0x310000) returned 1 [0172.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0172.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0172.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UEjFQfiUE0cHCwyiRVml9x2esrd", cchWideChar=27, lpMultiByteStr=0x38c3e0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UEjFQfiUE0cHCwyiRVml9x2esrd", lpUsedDefaultChar=0x0) returned 27 [0172.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0172.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0172.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0172.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0172.097] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0172.098] WriteFile (in: hFile=0x698, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x352f898*=0xe6e, lpOverlapped=0x0) returned 1 [0172.098] CloseHandle (hObject=0x698) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0172.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbad80 | out: hHeap=0x310000) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5333608 | out: hHeap=0x310000) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba6f0 | out: hHeap=0x310000) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0172.100] CryptDestroyKey (hKey=0x5261308) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbd3a8 | out: hHeap=0x310000) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3717a0 | out: hHeap=0x310000) returned 1 [0172.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6240 | out: hHeap=0x310000) returned 1 [0172.100] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0172.100] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0172.100] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.100] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0172.120] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.120] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0172.121] CloseHandle (hObject=0x698) returned 1 [0172.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0172.121] RmStartSession () returned 0x0 [0172.125] RmRegisterResources () returned 0x0 [0172.130] RmGetList () returned 0x0 [0173.843] RmShutdown () returned 0x0 [0180.582] RmEndSession () returned 0x0 [0180.582] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261008) returned 1 [0180.582] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0180.583] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x20) returned 1 [0180.583] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0180.583] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0180.583] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0180.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2088 [0180.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677d020 [0180.909] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0180.910] ReadFile (in: hFile=0x698, lpBuffer=0x677d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x677d040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0180.995] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0180.995] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.995] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.995] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.995] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.995] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.995] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.996] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0180.996] WriteFile (in: hFile=0x698, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0180.997] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0180.997] WriteFile (in: hFile=0x698, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0180.997] WriteFile (in: hFile=0x698, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0180.997] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677d020 | out: hHeap=0x310000) returned 1 [0181.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2088 | out: hHeap=0x310000) returned 1 [0181.117] CloseHandle (hObject=0x698) returned 1 [0181.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0181.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0181.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0181.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327000 [0181.119] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0181.120] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0181.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0181.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0181.120] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0181.120] GetLastError () returned 0x0 [0181.120] SetLastError (dwErrCode=0x0) [0181.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.121] GetLastError () returned 0x0 [0181.121] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0181.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] GetLastError () returned 0x0 [0181.122] SetLastError (dwErrCode=0x0) [0181.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab8b8 [0181.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0181.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0181.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CqBUvxIGoX1t1IDWUkYIKSGN", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0181.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0181.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CqBUvxIGoX1t1IDWUkYIKSGN", cchWideChar=24, lpMultiByteStr=0x38c3b8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CqBUvxIGoX1t1IDWUkYIKSGN", lpUsedDefaultChar=0x0) returned 24 [0181.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab8b8 | out: hHeap=0x310000) returned 1 [0181.122] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0181.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5409c80 [0181.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0181.123] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0181.124] WriteFile (in: hFile=0x698, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x352f898*=0xe6b, lpOverlapped=0x0) returned 1 [0181.125] CloseHandle (hObject=0x698) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327000 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0181.126] CryptDestroyKey (hKey=0x5261008) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea940 | out: hHeap=0x310000) returned 1 [0181.126] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6880 | out: hHeap=0x310000) returned 1 [0181.126] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0181.126] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0181.127] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.127] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0181.497] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.497] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0181.497] CloseHandle (hObject=0x698) returned 1 [0181.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0181.497] RmStartSession () returned 0x0 [0182.020] RmRegisterResources () returned 0x0 [0182.024] RmGetList () returned 0x0 [0183.296] RmShutdown () returned 0x0 [0184.377] RmEndSession () returned 0x0 [0184.379] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x52619c8) returned 1 [0184.379] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0184.379] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0184.380] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0184.380] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0184.380] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0184.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0184.381] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c5020 [0184.696] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0184.697] ReadFile (in: hFile=0x5c8, lpBuffer=0x58c5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x58c5040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0184.735] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0184.735] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.735] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.735] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.736] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.737] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0184.737] WriteFile (in: hFile=0x5c8, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0184.737] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0184.738] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0184.738] WriteFile (in: hFile=0x5c8, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0184.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c5020 | out: hHeap=0x310000) returned 1 [0185.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0185.130] CloseHandle (hObject=0x5c8) returned 1 [0185.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0185.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0900 [0185.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0185.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0720 [0185.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0185.132] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0185.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0185.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0185.133] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0185.133] GetLastError () returned 0x0 [0185.133] SetLastError (dwErrCode=0x0) [0185.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0185.133] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] GetLastError () returned 0x0 [0185.134] SetLastError (dwErrCode=0x0) [0185.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0185.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x352f760, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7L6vG", lpUsedDefaultChar=0x0) returned 5 [0185.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0185.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0185.134] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0185.135] WriteFile (in: hFile=0x5c8, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x352f898*=0xe58, lpOverlapped=0x0) returned 1 [0185.136] CloseHandle (hObject=0x5c8) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0185.137] CryptDestroyKey (hKey=0x52619c8) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e30 | out: hHeap=0x310000) returned 1 [0185.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6ec0 | out: hHeap=0x310000) returned 1 [0185.137] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0185.138] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0185.138] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.138] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0185.178] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.178] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0185.179] CloseHandle (hObject=0x5c8) returned 1 [0185.179] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f05b8 [0185.179] RmStartSession () returned 0x0 [0185.181] RmRegisterResources () returned 0x0 [0185.185] RmGetList () returned 0x0 [0188.740] RmShutdown () returned 0x0 [0191.362] RmEndSession () returned 0x0 [0191.365] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x35d908) returned 1 [0191.366] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0191.366] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x20) returned 1 [0191.366] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0191.366] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0191.366] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0191.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0191.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6724020 [0191.547] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0191.547] ReadFile (in: hFile=0x5c8, lpBuffer=0x6724040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x6724040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0191.552] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0191.552] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.552] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.552] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.552] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.552] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.553] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0191.553] WriteFile (in: hFile=0x5c8, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0191.554] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0191.554] WriteFile (in: hFile=0x5c8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0191.554] WriteFile (in: hFile=0x5c8, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0191.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6724020 | out: hHeap=0x310000) returned 1 [0191.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0191.580] CloseHandle (hObject=0x5c8) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0191.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0191.582] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0810 [0191.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0191.583] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.583] SetLastError (dwErrCode=0x0) [0191.583] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0191.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.584] SetLastError (dwErrCode=0x0) [0191.584] GetLastError () returned 0x0 [0191.585] SetLastError (dwErrCode=0x0) [0191.585] GetLastError () returned 0x0 [0191.585] SetLastError (dwErrCode=0x0) [0191.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bad5c8 [0191.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0191.585] GetLastError () returned 0x0 [0191.585] SetLastError (dwErrCode=0x0) [0191.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0191.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0191.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0191.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c4d0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0191.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad5c8 | out: hHeap=0x310000) returned 1 [0191.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540c818 [0191.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540f3b0 [0191.585] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0191.585] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0191.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x352f898*=0xe6c, lpOverlapped=0x0) returned 1 [0191.587] CloseHandle (hObject=0x5c8) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540c818 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0810 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0191.587] CryptDestroyKey (hKey=0x35d908) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f05b8 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d199c0 | out: hHeap=0x310000) returned 1 [0191.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6e70 | out: hHeap=0x310000) returned 1 [0191.587] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0191.587] CreateFileW (lpFileName="C:\\\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0191.588] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.588] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0191.589] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.589] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0191.589] CloseHandle (hObject=0x5c8) returned 1 [0191.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0191.589] RmStartSession () returned 0x0 [0192.091] RmRegisterResources () returned 0x0 [0192.405] RmGetList () returned 0x0 [0193.092] RmShutdown () returned 0x0 [0197.001] RmEndSession () returned 0x0 [0197.002] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260f88) returned 1 [0197.002] GetFileAttributesW (lpFileName="C:\\\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0197.002] SetFileAttributesW (lpFileName="C:\\\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x20) returned 1 [0197.002] CreateFileW (lpFileName="C:\\\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0197.002] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0197.002] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=69632) returned 1 [0197.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b7cf48 [0197.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c7020 [0197.456] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0197.456] ReadFile (in: hFile=0x668, lpBuffer=0x65c7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x65c7040*, lpNumberOfBytesRead=0x352f924*=0x11000, lpOverlapped=0x0) returned 1 [0197.463] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.463] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.463] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.464] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.464] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.464] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.464] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.464] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7cf60*, pdwDataLen=0x352f898*=0x2000) returned 1 [0197.464] WriteFile (in: hFile=0x668, lpBuffer=0x4b7cf60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b7cf60*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0197.464] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0197.464] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0197.464] WriteFile (in: hFile=0x668, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0197.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c7020 | out: hHeap=0x310000) returned 1 [0197.903] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7cf48 | out: hHeap=0x310000) returned 1 [0197.903] CloseHandle (hObject=0x668) returned 1 [0197.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0197.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0197.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0197.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391e50 [0197.903] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0197.904] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="C:\\\\Logs\\Windows PowerShell.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\windows powershell.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0198.298] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a88 [0198.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0198.305] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc098 [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.305] GetLastError () returned 0x0 [0198.305] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.306] SetLastError (dwErrCode=0x0) [0198.306] GetLastError () returned 0x0 [0198.307] SetLastError (dwErrCode=0x0) [0198.307] GetLastError () returned 0x0 [0198.307] SetLastError (dwErrCode=0x0) [0198.307] GetLastError () returned 0x0 [0198.307] SetLastError (dwErrCode=0x0) [0198.307] GetLastError () returned 0x0 [0198.307] SetLastError (dwErrCode=0x0) [0198.307] GetLastError () returned 0x0 [0198.307] SetLastError (dwErrCode=0x0) [0198.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0198.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0198.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc098 | out: hHeap=0x310000) returned 1 [0198.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0198.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0198.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x38c3b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lRTaZqgzay52GZY8", lpUsedDefaultChar=0x0) returned 16 [0198.308] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0198.308] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0198.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0198.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0198.309] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0198.311] WriteFile (in: hFile=0x668, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x352f898*=0xe63, lpOverlapped=0x0) returned 1 [0198.334] CloseHandle (hObject=0x668) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a88 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391e50 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0198.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0199.190] CryptDestroyKey (hKey=0x5260f88) returned 1 [0199.190] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0199.190] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3991f0 | out: hHeap=0x310000) returned 1 [0199.190] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44e48 | out: hHeap=0x310000) returned 1 [0199.190] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0199.190] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0199.191] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.191] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0199.192] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.192] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0199.192] CloseHandle (hObject=0x5b0) returned 1 [0199.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a89a8 [0199.193] RmStartSession () returned 0x0 [0199.315] RmRegisterResources () returned 0x0 [0199.319] RmGetList () returned 0x0 [0199.734] RmShutdown () returned 0x0 [0201.490] RmEndSession () returned 0x0 [0201.491] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x35d6c8) returned 1 [0201.491] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0201.491] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", dwFileAttributes=0x20) returned 0 [0201.491] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.491] CryptDestroyKey (hKey=0x35d6c8) returned 1 [0201.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a89a8 | out: hHeap=0x310000) returned 1 [0201.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ca38 | out: hHeap=0x310000) returned 1 [0201.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c083c0 | out: hHeap=0x310000) returned 1 [0201.492] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0201.492] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0201.492] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.492] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0201.506] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.506] ReadFile (in: hFile=0x5a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0201.506] CloseHandle (hObject=0x5a8) returned 1 [0201.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0201.506] RmStartSession () returned 0x0 [0201.507] RmRegisterResources () returned 0x0 [0202.306] RmGetList () returned 0x0 [0202.702] RmShutdown () returned 0x0 [0204.183] RmEndSession () returned 0x0 [0204.460] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261048) returned 1 [0204.460] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0204.460] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui", dwFileAttributes=0x20) returned 0 [0204.460] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.460] CryptDestroyKey (hKey=0x5261048) returned 1 [0204.460] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0204.460] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92040 | out: hHeap=0x310000) returned 1 [0204.460] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07ec0 | out: hHeap=0x310000) returned 1 [0204.460] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0204.460] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0204.644] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.644] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0204.646] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.646] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0204.646] CloseHandle (hObject=0x4d4) returned 1 [0204.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92190 [0204.646] RmStartSession () returned 0x0 [0204.820] RmRegisterResources () returned 0x0 [0204.820] RmGetList () returned 0x0 [0204.953] RmShutdown () returned 0x0 [0208.873] RmEndSession () returned 0x0 [0208.928] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261488) returned 1 [0208.928] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0208.928] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0208.928] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.928] CryptDestroyKey (hKey=0x5261488) returned 1 [0208.928] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92190 | out: hHeap=0x310000) returned 1 [0208.928] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92d60 | out: hHeap=0x310000) returned 1 [0208.928] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08500 | out: hHeap=0x310000) returned 1 [0208.928] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0208.928] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0208.928] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.928] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0208.932] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.932] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0208.932] CloseHandle (hObject=0x694) returned 1 [0208.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92f58 [0208.932] RmStartSession () returned 0x0 [0209.262] RmRegisterResources () returned 0x0 [0209.266] RmGetList () returned 0x0 [0211.500] RmShutdown () returned 0x0 [0211.954] RmEndSession () returned 0x0 [0211.955] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x35d988) returned 1 [0211.955] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0211.955] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml", dwFileAttributes=0x20) returned 0 [0211.955] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.956] CryptDestroyKey (hKey=0x35d988) returned 1 [0211.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92f58 | out: hHeap=0x310000) returned 1 [0211.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0211.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a54c0 | out: hHeap=0x310000) returned 1 [0211.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0211.956] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0211.956] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.956] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0212.007] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.007] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0212.007] CloseHandle (hObject=0x698) returned 1 [0212.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcd90 [0212.007] RmStartSession () returned 0x0 [0212.011] RmRegisterResources () returned 0x0 [0212.015] RmGetList () returned 0x0 [0212.500] RmShutdown () returned 0x0 [0214.134] RmEndSession () returned 0x0 [0214.135] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261888) returned 1 [0214.135] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0214.135] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml", dwFileAttributes=0x20) returned 0 [0214.135] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.135] CryptDestroyKey (hKey=0x5261888) returned 1 [0214.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0214.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc2c8 | out: hHeap=0x310000) returned 1 [0214.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5970 | out: hHeap=0x310000) returned 1 [0214.135] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0214.135] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0214.136] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.136] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0214.173] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.173] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0214.173] CloseHandle (hObject=0x698) returned 1 [0214.173] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd4b0 [0214.173] RmStartSession () returned 0x0 [0214.174] RmRegisterResources () returned 0x0 [0214.179] RmGetList () returned 0x0 [0215.405] RmShutdown () returned 0x0 [0219.508] RmEndSession () returned 0x0 [0219.681] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261688) returned 1 [0219.681] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0219.681] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml", dwFileAttributes=0x20) returned 0 [0219.681] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.681] CryptDestroyKey (hKey=0x5261688) returned 1 [0219.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd4b0 | out: hHeap=0x310000) returned 1 [0219.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb028 | out: hHeap=0x310000) returned 1 [0219.682] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5790 | out: hHeap=0x310000) returned 1 [0219.682] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0219.682] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0219.682] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.682] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0219.846] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.846] ReadFile (in: hFile=0x698, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0219.846] CloseHandle (hObject=0x698) returned 1 [0219.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0219.846] RmStartSession () returned 0x0 [0220.021] RmRegisterResources () returned 0x0 [0220.021] RmGetList () returned 0x0 [0220.196] RmShutdown () returned 0x0 [0221.988] RmEndSession () returned 0x0 [0222.314] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x52619c8) returned 1 [0222.314] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0222.314] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0222.315] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.315] CryptDestroyKey (hKey=0x52619c8) returned 1 [0222.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0222.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0222.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c142e0 | out: hHeap=0x310000) returned 1 [0222.315] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0222.315] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0222.315] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.315] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0222.321] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.321] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0222.321] CloseHandle (hObject=0x5b0) returned 1 [0222.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0222.321] RmStartSession () returned 0x0 [0222.442] RmRegisterResources () returned 0x0 [0222.443] RmGetList () returned 0x0 [0222.936] RmShutdown () returned 0x0 [0225.258] RmEndSession () returned 0x0 [0225.624] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261348) returned 1 [0225.624] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0225.624] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.624] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.625] CryptDestroyKey (hKey=0x5261348) returned 1 [0225.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0225.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eef18 | out: hHeap=0x310000) returned 1 [0225.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c148d0 | out: hHeap=0x310000) returned 1 [0225.625] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0225.625] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0225.628] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.628] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0225.629] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.629] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0225.629] CloseHandle (hObject=0x52c) returned 1 [0225.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0225.629] RmStartSession () returned 0x0 [0225.716] RmRegisterResources () returned 0x0 [0225.716] RmGetList () returned 0x0 [0225.764] RmShutdown () returned 0x0 [0227.551] RmEndSession () returned 0x0 [0228.444] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261488) returned 1 [0228.444] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0228.444] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", dwFileAttributes=0x20) returned 0 [0228.444] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.444] CryptDestroyKey (hKey=0x5261488) returned 1 [0228.444] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0228.444] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee348 | out: hHeap=0x310000) returned 1 [0228.444] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14d30 | out: hHeap=0x310000) returned 1 [0228.444] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0228.444] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0228.469] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.469] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0228.579] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.579] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0228.579] CloseHandle (hObject=0x56c) returned 1 [0228.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0228.580] RmStartSession () returned 0x0 [0228.582] RmRegisterResources () returned 0x0 [0228.583] RmGetList () returned 0x0 [0228.773] RmShutdown () returned 0x0 [0229.633] RmEndSession () returned 0x0 [0229.801] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260e08) returned 1 [0229.801] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0229.801] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x20) returned 0 [0229.801] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.801] CryptDestroyKey (hKey=0x5260e08) returned 1 [0229.801] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0229.801] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee7e0 | out: hHeap=0x310000) returned 1 [0229.801] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14ec0 | out: hHeap=0x310000) returned 1 [0229.802] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0229.802] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0229.802] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.802] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0229.807] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.807] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0229.807] CloseHandle (hObject=0x56c) returned 1 [0229.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0229.807] RmStartSession () returned 0x0 [0229.920] RmRegisterResources () returned 0x0 [0229.923] RmGetList () returned 0x0 [0230.133] RmShutdown () returned 0x0 [0230.929] RmEndSession () returned 0x0 [0231.745] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x52613c8) returned 1 [0231.745] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0231.746] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adovbs.inc", dwFileAttributes=0x20) returned 0 [0231.746] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.746] CryptDestroyKey (hKey=0x52613c8) returned 1 [0231.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0231.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0231.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c00 | out: hHeap=0x310000) returned 1 [0231.746] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0231.746] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0231.746] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.746] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0231.786] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.786] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0231.786] CloseHandle (hObject=0x664) returned 1 [0231.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ba0 [0231.786] RmStartSession () returned 0x0 [0231.788] RmRegisterResources () returned 0x0 [0231.792] RmGetList () returned 0x0 [0232.796] RmShutdown () returned 0x0 [0235.996] RmEndSession () returned 0x0 [0236.034] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261508) returned 1 [0236.034] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0236.034] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", dwFileAttributes=0x20) returned 0 [0236.034] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.034] CryptDestroyKey (hKey=0x5261508) returned 1 [0236.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0236.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0236.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19290 | out: hHeap=0x310000) returned 1 [0236.035] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0236.035] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0236.035] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.035] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0236.036] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.036] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0236.036] CloseHandle (hObject=0x664) returned 1 [0236.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19a38 [0236.036] RmStartSession () returned 0x0 [0236.295] RmRegisterResources () returned 0x0 [0236.296] RmGetList () returned 0x0 [0236.386] RmShutdown () returned 0x0 [0236.652] RmEndSession () returned 0x0 [0236.653] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260f88) returned 1 [0236.653] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0236.653] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf", dwFileAttributes=0x20) returned 1 [0236.653] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0236.653] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0236.653] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=632) returned 1 [0236.653] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x68620a0 [0236.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0237.023] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0237.023] ReadFile (in: hFile=0x650, lpBuffer=0x6219040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x6219040*, lpNumberOfBytesRead=0x352f924*=0x278, lpOverlapped=0x0) returned 1 [0237.024] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0237.024] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x68620c0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x68620c0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0237.024] WriteFile (in: hFile=0x650, lpBuffer=0x68620c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x68620c0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0237.025] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0237.025] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0237.025] WriteFile (in: hFile=0x650, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0237.025] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6219020 | out: hHeap=0x310000) returned 1 [0237.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x68620a0 | out: hHeap=0x310000) returned 1 [0237.374] CloseHandle (hObject=0x650) returned 1 [0237.374] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0237.374] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0237.374] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a320 [0237.375] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0237.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0237.375] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.bdcddcbaad"), dwFlags=0x1) returned 1 [0237.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0237.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0237.395] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.395] SetLastError (dwErrCode=0x0) [0237.395] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] GetLastError () returned 0x0 [0237.396] SetLastError (dwErrCode=0x0) [0237.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0237.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0237.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x352f760, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8kda2ctzsSng7DS", lpUsedDefaultChar=0x0) returned 15 [0237.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0237.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0237.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0237.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0237.396] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0237.397] WriteFile (in: hFile=0x650, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x352f898*=0xe62, lpOverlapped=0x0) returned 1 [0237.398] CloseHandle (hObject=0x650) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0237.398] CryptDestroyKey (hKey=0x5260f88) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19a38 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a318 | out: hHeap=0x310000) returned 1 [0237.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572158 | out: hHeap=0x310000) returned 1 [0237.399] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0237.399] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0237.399] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.399] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0237.413] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.413] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0237.413] CloseHandle (hObject=0x650) returned 1 [0237.413] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a140 [0237.413] RmStartSession () returned 0x0 [0237.416] RmRegisterResources () returned 0x0 [0237.419] RmGetList () returned 0x0 [0237.814] RmShutdown () returned 0x0 [0238.305] RmEndSession () returned 0x0 [0238.528] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260f88) returned 1 [0238.528] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0238.528] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf", dwFileAttributes=0x20) returned 1 [0238.528] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0238.528] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0238.528] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3144) returned 1 [0238.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5efb0 [0238.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5804020 [0238.546] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0238.546] ReadFile (in: hFile=0x650, lpBuffer=0x5804040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x5804040*, lpNumberOfBytesRead=0x352f924*=0xc48, lpOverlapped=0x0) returned 1 [0238.578] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0238.578] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5efc0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5efc0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0238.578] WriteFile (in: hFile=0x650, lpBuffer=0x4b5efc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b5efc0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0238.578] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0238.578] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0238.578] WriteFile (in: hFile=0x650, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0238.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5804020 | out: hHeap=0x310000) returned 1 [0238.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5efb0 | out: hHeap=0x310000) returned 1 [0238.583] CloseHandle (hObject=0x650) returned 1 [0238.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0238.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0238.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ba0 [0238.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0238.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0238.583] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0238.584] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0238.584] GetLastError () returned 0x0 [0238.584] SetLastError (dwErrCode=0x0) [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0238.584] GetLastError () returned 0x0 [0238.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0238.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x38c070, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VMExNofJE4VFz9a2IHu", lpUsedDefaultChar=0x0) returned 19 [0238.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0238.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0238.585] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0238.585] WriteFile (in: hFile=0x650, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x352f898*=0xe66, lpOverlapped=0x0) returned 1 [0238.586] CloseHandle (hObject=0x650) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0238.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0238.586] CryptDestroyKey (hKey=0x5260f88) returned 1 [0238.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a140 | out: hHeap=0x310000) returned 1 [0238.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39b98 | out: hHeap=0x310000) returned 1 [0238.587] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55721f8 | out: hHeap=0x310000) returned 1 [0238.587] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0238.587] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0238.587] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.587] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0238.631] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.631] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0238.631] CloseHandle (hObject=0x650) returned 1 [0238.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0238.632] RmStartSession () returned 0x0 [0238.634] RmRegisterResources () returned 0x0 [0238.634] RmGetList () returned 0x0 [0240.617] RmShutdown () returned 0x0 [0243.400] RmEndSession () returned 0x0 [0243.400] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260c88) returned 1 [0243.400] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0243.401] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties", dwFileAttributes=0x20) returned 1 [0243.401] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0243.401] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0243.401] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3223) returned 1 [0243.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0243.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5629020 [0243.960] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0243.960] ReadFile (in: hFile=0x650, lpBuffer=0x5629040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x5629040*, lpNumberOfBytesRead=0x352f924*=0xc97, lpOverlapped=0x0) returned 1 [0243.961] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0243.962] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x352f898*=0x2000) returned 1 [0243.962] WriteFile (in: hFile=0x650, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0243.962] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0243.962] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0243.962] WriteFile (in: hFile=0x650, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0243.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5629020 | out: hHeap=0x310000) returned 1 [0245.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0245.567] CloseHandle (hObject=0x650) returned 1 [0245.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0245.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbb98 [0245.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0245.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc718 [0245.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0245.567] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0245.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0245.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0245.568] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0245.568] GetLastError () returned 0x0 [0245.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0245.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x352f760, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0245.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0245.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0245.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0245.568] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0245.569] WriteFile (in: hFile=0x650, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x352f898*=0xe5c, lpOverlapped=0x0) returned 1 [0245.570] CloseHandle (hObject=0x650) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc718 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0245.570] CryptDestroyKey (hKey=0x5260c88) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570cc0 | out: hHeap=0x310000) returned 1 [0245.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572568 | out: hHeap=0x310000) returned 1 [0245.570] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0245.570] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0245.571] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.571] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0245.573] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.573] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0245.573] CloseHandle (hObject=0x650) returned 1 [0245.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0245.574] RmStartSession () returned 0x0 [0245.576] RmRegisterResources () returned 0x0 [0245.576] RmGetList () returned 0x0 [0245.600] RmShutdown () returned 0x0 [0246.345] RmEndSession () returned 0x0 [0246.346] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261508) returned 1 [0246.346] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0246.346] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf", dwFileAttributes=0x20) returned 1 [0246.346] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0246.346] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0246.346] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=698236) returned 1 [0246.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0246.346] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7801020 [0246.932] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0246.932] GetLastError () returned 0x0 [0246.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0246.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0246.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c3e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0246.932] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0246.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0246.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0246.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0246.932] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0246.933] WriteFile (in: hFile=0x650, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x352f898*=0xe63, lpOverlapped=0x0) returned 1 [0246.934] CloseHandle (hObject=0x650) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0246.934] CryptDestroyKey (hKey=0x5261508) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570df0 | out: hHeap=0x310000) returned 1 [0246.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53526f0 | out: hHeap=0x310000) returned 1 [0246.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0246.935] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0246.937] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.937] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0246.938] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.938] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0246.938] CloseHandle (hObject=0x650) returned 1 [0246.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0246.938] RmStartSession () returned 0x0 [0246.940] RmRegisterResources () returned 0x0 [0246.944] RmGetList () returned 0x0 [0247.830] RmShutdown () [0250.015] RmEndSession () returned 0x0 [0250.016] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261608) returned 1 [0250.016] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0250.016] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0250.016] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0250.016] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0250.016] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=165) returned 1 [0250.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54b7e48 [0250.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6210020 [0250.517] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0250.517] GetLastError () returned 0x0 [0250.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0250.517] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0250.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x38c3b8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mq0Gric0JR23PHFSN5QG4V5474", lpUsedDefaultChar=0x0) returned 26 [0250.517] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ed650 | out: hHeap=0x310000) returned 1 [0250.517] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0250.517] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0250.517] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0250.517] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0250.518] WriteFile (in: hFile=0x650, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x352f898*=0xe6d, lpOverlapped=0x0) returned 1 [0250.519] CloseHandle (hObject=0x650) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9de8 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0250.519] CryptDestroyKey (hKey=0x5261608) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efb90 | out: hHeap=0x310000) returned 1 [0250.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352650 | out: hHeap=0x310000) returned 1 [0250.519] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0250.519] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0250.520] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.520] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0250.532] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.532] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0250.532] CloseHandle (hObject=0x650) returned 1 [0250.532] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0250.532] RmStartSession () returned 0x0 [0250.536] RmRegisterResources () returned 0x0 [0250.539] RmGetList () returned 0x0 [0251.649] RmShutdown () returned 0x0 [0255.394] RmEndSession () returned 0x0 [0255.395] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261488) returned 1 [0255.395] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0255.395] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access", dwFileAttributes=0x20) returned 1 [0255.396] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0255.396] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0255.396] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3998) returned 1 [0255.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0255.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f7020 [0255.414] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0255.414] ReadFile (in: hFile=0x650, lpBuffer=0x56f7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x56f7040*, lpNumberOfBytesRead=0x352f924*=0xf9e, lpOverlapped=0x0) returned 1 [0255.418] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0255.418] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d60020*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d60020*, pdwDataLen=0x352f898*=0x2000) returned 1 [0255.418] WriteFile (in: hFile=0x650, lpBuffer=0x5d60020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5d60020*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0255.418] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0255.418] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0255.418] WriteFile (in: hFile=0x650, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0255.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f7020 | out: hHeap=0x310000) returned 1 [0255.423] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d60010 | out: hHeap=0x310000) returned 1 [0255.423] CloseHandle (hObject=0x650) returned 1 [0255.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0255.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0255.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0255.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0255.424] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0255.424] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.bdcddcbaad"), dwFlags=0x1) returned 1 [0255.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0255.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a050 [0255.424] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0255.424] GetLastError () returned 0x0 [0255.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0255.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x352f760, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx231C421W", lpUsedDefaultChar=0x0) returned 10 [0255.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0255.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0255.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0255.425] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0255.426] WriteFile (in: hFile=0x650, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x352f898*=0xe5d, lpOverlapped=0x0) returned 1 [0255.427] CloseHandle (hObject=0x650) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a050 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0255.427] CryptDestroyKey (hKey=0x5261488) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570178 | out: hHeap=0x310000) returned 1 [0255.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353500 | out: hHeap=0x310000) returned 1 [0255.427] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0255.427] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0255.427] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.427] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0255.832] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.832] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0255.832] CloseHandle (hObject=0x650) returned 1 [0255.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0255.832] RmStartSession () returned 0x0 [0256.303] RmRegisterResources () returned 0x0 [0256.303] RmGetList () returned 0x0 [0256.376] RmShutdown () returned 0x0 [0257.370] RmEndSession () returned 0x0 [0257.371] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261888) returned 1 [0257.371] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0257.371] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\release", dwFileAttributes=0x20) returned 1 [0257.371] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0257.371] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0257.371] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=528) returned 1 [0257.371] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0257.372] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58e0020 [0258.091] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0258.091] GetLastError () returned 0x0 [0258.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0258.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x38c1d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Jqd1nQTWMi6MgqEEJIg", lpUsedDefaultChar=0x0) returned 20 [0258.092] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0258.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0258.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0258.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0258.092] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0258.093] WriteFile (in: hFile=0x660, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x352f898*=0xe67, lpOverlapped=0x0) returned 1 [0258.094] CloseHandle (hObject=0x660) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0258.094] CryptDestroyKey (hKey=0x5261888) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2310 | out: hHeap=0x310000) returned 1 [0258.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352100 | out: hHeap=0x310000) returned 1 [0258.094] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0258.094] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0258.094] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.094] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0258.097] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.097] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0258.097] CloseHandle (hObject=0x660) returned 1 [0258.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0a148 [0258.097] RmStartSession () returned 0x0 [0258.100] RmRegisterResources () returned 0x0 [0258.100] RmGetList () returned 0x0 [0258.302] RmShutdown () returned 0x0 [0260.684] RmEndSession () returned 0x0 [0260.862] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261888) returned 1 [0260.862] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0260.862] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0260.863] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0260.863] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0260.863] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=496513) returned 1 [0260.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c89228 [0260.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e3020 [0261.902] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0261.902] GetLastError () returned 0x0 [0261.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0261.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x352f760, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3", lpUsedDefaultChar=0x0) returned 1 [0261.902] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0261.902] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0261.902] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0261.903] WriteFile (in: hFile=0x660, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x352f898*=0xe54, lpOverlapped=0x0) returned 1 [0261.904] CloseHandle (hObject=0x660) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05a98 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f440 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b0b0 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0261.904] CryptDestroyKey (hKey=0x5261888) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0a148 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa1f8 | out: hHeap=0x310000) returned 1 [0261.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351ca0 | out: hHeap=0x310000) returned 1 [0261.904] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0261.904] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0261.905] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.905] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0262.072] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.072] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0262.072] CloseHandle (hObject=0x660) returned 1 [0262.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f044d8 [0262.072] RmStartSession () returned 0x0 [0262.075] RmRegisterResources () returned 0x0 [0262.076] RmGetList () returned 0x0 [0262.097] RmShutdown () returned 0x0 [0262.811] RmEndSession () returned 0x0 [0262.914] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260cc8) returned 1 [0262.914] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0262.914] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0262.914] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0262.914] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0262.914] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=1261) returned 1 [0262.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c72020 [0262.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5899020 [0262.939] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0262.939] GetLastError () returned 0x0 [0262.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0262.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x352f760, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0262.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0262.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0262.939] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0262.940] WriteFile (in: hFile=0x660, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x352f898*=0xe57, lpOverlapped=0x0) returned 1 [0262.941] CloseHandle (hObject=0x660) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04220 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a06a8 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04de8 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0262.942] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f044d8 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348520 | out: hHeap=0x310000) returned 1 [0262.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19830 | out: hHeap=0x310000) returned 1 [0262.942] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0262.942] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0262.942] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.942] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0263.009] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0263.009] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0263.009] CloseHandle (hObject=0x660) returned 1 [0263.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09da8 [0263.009] RmStartSession () returned 0x0 [0263.805] RmRegisterResources () returned 0x0 [0263.805] RmGetList () returned 0x0 [0263.839] RmShutdown () returned 0x0 [0264.746] RmEndSession () returned 0x0 [0264.747] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260cc8) returned 1 [0264.747] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0264.747] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.747] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0264.747] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0264.747] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=1261) returned 1 [0264.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x675e0a8 [0264.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7af1020 [0266.581] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0266.581] GetLastError () returned 0x0 [0266.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x352f760, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.581] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0266.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0266.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0266.581] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0266.581] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0266.582] WriteFile (in: hFile=0x558, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x352f898*=0xe61, lpOverlapped=0x0) returned 1 [0266.583] CloseHandle (hObject=0x558) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5848 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5b9a710 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5760 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0266.583] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09da8 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5347870 | out: hHeap=0x310000) returned 1 [0266.583] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19510 | out: hHeap=0x310000) returned 1 [0266.583] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0266.584] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0266.584] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.584] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0266.589] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.589] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0266.590] CloseHandle (hObject=0x558) returned 1 [0266.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x4ba5760 [0266.590] RmStartSession () returned 0x0 [0266.708] RmRegisterResources () returned 0x0 [0266.713] RmGetList () returned 0x0 [0267.082] RmShutdown () returned 0x0 [0268.166] RmEndSession () returned 0x0 [0268.167] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260cc8) returned 1 [0268.167] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0268.167] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0268.167] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0268.167] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0268.168] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3375) returned 1 [0268.168] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0268.168] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf3020 [0268.191] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0268.191] GetLastError () returned 0x0 [0268.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0268.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0268.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x38c520, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3PiqIn2wVpHXSiax4SL", lpUsedDefaultChar=0x0) returned 20 [0268.192] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0268.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0268.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0268.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0268.192] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0268.193] WriteFile (in: hFile=0x558, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x352f898*=0xe67, lpOverlapped=0x0) returned 1 [0268.193] CloseHandle (hObject=0x558) returned 1 [0268.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0268.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba0400 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a07a0 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0268.194] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5760 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53491d0 | out: hHeap=0x310000) returned 1 [0268.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18cf0 | out: hHeap=0x310000) returned 1 [0268.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0268.194] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0268.194] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.194] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0268.218] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.218] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0268.218] CloseHandle (hObject=0x558) returned 1 [0268.219] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0268.219] RmStartSession () returned 0x0 [0268.220] RmRegisterResources () returned 0x0 [0268.224] RmGetList () returned 0x0 [0269.114] RmShutdown () returned 0x0 [0270.252] RmEndSession () returned 0x0 [0270.253] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260f88) returned 1 [0270.253] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0270.253] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF", dwFileAttributes=0x220) returned 1 [0270.253] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0270.253] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0270.253] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=3484) returned 1 [0270.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0270.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c5020 [0270.278] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0270.278] GetLastError () returned 0x0 [0270.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0270.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0270.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c3b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0270.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89960 | out: hHeap=0x310000) returned 1 [0270.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0270.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0270.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0270.279] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0270.393] WriteFile (in: hFile=0x558, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x352f898*=0xe6e, lpOverlapped=0x0) returned 1 [0270.394] CloseHandle (hObject=0x558) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc158 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0270.394] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0270.394] CryptDestroyKey (hKey=0x5260f88) returned 1 [0270.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0270.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a57c8 | out: hHeap=0x310000) returned 1 [0270.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3130 | out: hHeap=0x310000) returned 1 [0270.395] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0270.395] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0270.395] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.395] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0270.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.437] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0270.437] CloseHandle (hObject=0x558) returned 1 [0270.437] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0270.437] RmStartSession () returned 0x0 [0270.439] RmRegisterResources () returned 0x0 [0270.440] RmGetList () returned 0x0 [0271.922] RmShutdown () returned 0x0 [0272.127] RmEndSession () returned 0x0 [0272.127] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261ac8) returned 1 [0272.127] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0272.127] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF", dwFileAttributes=0x220) returned 1 [0272.128] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0272.128] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0272.128] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=1146) returned 1 [0272.128] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0272.128] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x580c020 [0274.600] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0274.600] GetLastError () returned 0x0 [0274.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0274.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x352f760, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JI3sLVWO", lpUsedDefaultChar=0x0) returned 8 [0274.600] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0274.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0274.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3ef5a8 [0274.600] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0274.601] WriteFile (in: hFile=0x558, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x352f898*=0xe5b, lpOverlapped=0x0) returned 1 [0274.602] CloseHandle (hObject=0x558) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef5a8 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cbb38 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0274.602] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0274.603] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0274.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0274.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5698 | out: hHeap=0x310000) returned 1 [0274.603] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e35e0 | out: hHeap=0x310000) returned 1 [0274.603] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0274.603] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0274.603] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.603] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0274.604] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.605] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0274.605] CloseHandle (hObject=0x558) returned 1 [0274.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0274.605] RmStartSession () returned 0x0 [0274.606] RmRegisterResources () returned 0x0 [0274.606] RmGetList () returned 0x0 [0274.628] RmShutdown () returned 0x0 [0275.412] RmEndSession () returned 0x0 [0275.505] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261948) returned 1 [0275.505] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0275.505] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF", dwFileAttributes=0x220) returned 1 [0275.506] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0275.506] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0275.506] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=10832) returned 1 [0275.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0275.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78dc020 [0275.581] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0275.582] GetLastError () returned 0x0 [0275.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x352f760, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.582] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0275.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0275.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.582] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0275.583] WriteFile (in: hFile=0x558, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x352f898*=0xe5e, lpOverlapped=0x0) returned 1 [0275.584] CloseHandle (hObject=0x558) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ceb820 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0275.584] CryptDestroyKey (hKey=0x5261948) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5ac0 | out: hHeap=0x310000) returned 1 [0275.584] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e31d0 | out: hHeap=0x310000) returned 1 [0275.584] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0275.584] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0275.584] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.584] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0275.668] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.668] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0275.668] CloseHandle (hObject=0x558) returned 1 [0275.668] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0275.668] RmStartSession () returned 0x0 [0275.669] RmRegisterResources () returned 0x0 [0275.670] RmGetList () returned 0x0 [0277.610] RmShutdown () returned 0x0 [0278.907] RmEndSession () returned 0x0 [0278.908] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261348) returned 1 [0278.908] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0278.908] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF", dwFileAttributes=0x220) returned 1 [0278.908] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0278.908] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0278.908] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=26332) returned 1 [0278.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0278.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d7020 [0279.725] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0279.725] ReadFile (in: hFile=0x558, lpBuffer=0x78d7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x78d7040*, lpNumberOfBytesRead=0x352f924*=0x66dc, lpOverlapped=0x0) returned 1 [0279.727] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0279.727] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000) returned 1 [0279.727] WriteFile (in: hFile=0x558, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0279.727] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000) returned 1 [0279.727] WriteFile (in: hFile=0x558, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0279.727] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000) returned 1 [0279.727] WriteFile (in: hFile=0x558, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0279.727] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x352f898*=0x2000) returned 1 [0279.727] WriteFile (in: hFile=0x558, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0279.727] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0279.728] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0279.728] WriteFile (in: hFile=0x558, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0279.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x78d7020 | out: hHeap=0x310000) returned 1 [0281.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0281.028] CloseHandle (hObject=0x558) returned 1 [0281.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0281.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0e48 [0281.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0281.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0281.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0e48 | out: hHeap=0x310000) returned 1 [0281.028] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0281.029] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0281.029] GetLastError () returned 0x0 [0281.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0281.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x38c480, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", lpUsedDefaultChar=0x0) returned 31 [0281.029] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e80360 | out: hHeap=0x310000) returned 1 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54ee468 [0281.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0281.029] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0281.030] WriteFile (in: hFile=0x558, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x352f898*=0xe72, lpOverlapped=0x0) returned 1 [0281.031] CloseHandle (hObject=0x558) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0281.031] CryptDestroyKey (hKey=0x5261348) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6440 | out: hHeap=0x310000) returned 1 [0281.031] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1e20 | out: hHeap=0x310000) returned 1 [0281.031] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0281.031] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0281.656] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.656] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0281.676] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.676] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0281.676] CloseHandle (hObject=0x450) returned 1 [0281.676] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0281.676] RmStartSession () returned 0x0 [0281.679] RmRegisterResources () returned 0x0 [0281.680] RmGetList () returned 0x0 [0281.702] RmShutdown () returned 0x0 [0283.878] RmEndSession () returned 0x0 [0283.879] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5260cc8) returned 1 [0283.879] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0283.879] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID", dwFileAttributes=0x220) returned 1 [0283.879] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0283.879] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0283.879] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=7384) returned 1 [0283.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0283.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78e6020 [0284.109] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0284.109] ReadFile (in: hFile=0x450, lpBuffer=0x78e6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x78e6040*, lpNumberOfBytesRead=0x352f924*=0x1cd8, lpOverlapped=0x0) returned 1 [0284.111] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0284.111] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0284.111] WriteFile (in: hFile=0x450, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0284.111] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0284.111] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0284.112] WriteFile (in: hFile=0x450, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0284.112] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x78e6020 | out: hHeap=0x310000) returned 1 [0284.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0284.142] CloseHandle (hObject=0x450) returned 1 [0284.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0284.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0284.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0284.142] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b62c8 [0284.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0284.142] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.bdcddcbaad"), dwFlags=0x1) returned 1 [0284.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0284.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0284.143] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0284.143] GetLastError () returned 0x0 [0284.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0284.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x352f760, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sW6xAztyt", lpUsedDefaultChar=0x0) returned 9 [0284.143] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0284.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0284.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0284.144] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0284.144] WriteFile (in: hFile=0x450, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x352f898*=0xe5c, lpOverlapped=0x0) returned 1 [0284.145] CloseHandle (hObject=0x450) returned 1 [0284.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0284.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0284.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0284.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b62c8 | out: hHeap=0x310000) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0284.146] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94178 | out: hHeap=0x310000) returned 1 [0284.146] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e22d0 | out: hHeap=0x310000) returned 1 [0284.146] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0284.146] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0284.146] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.146] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0284.148] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.148] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0284.149] CloseHandle (hObject=0x450) returned 1 [0284.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0284.149] RmStartSession () returned 0x0 [0284.150] RmRegisterResources () returned 0x0 [0284.150] RmGetList () returned 0x0 [0284.177] RmShutdown () returned 0x0 [0285.252] RmEndSession () returned 0x0 [0285.282] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261848) returned 1 [0285.282] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0285.282] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x220) returned 1 [0285.282] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0285.282] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0285.282] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=26748) returned 1 [0285.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0285.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5895020 [0285.817] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0285.817] ReadFile (in: hFile=0x450, lpBuffer=0x5895040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x5895040*, lpNumberOfBytesRead=0x352f924*=0x687c, lpOverlapped=0x0) returned 1 [0286.127] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0286.127] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000) returned 1 [0286.127] WriteFile (in: hFile=0x450, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0286.127] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000) returned 1 [0286.127] WriteFile (in: hFile=0x450, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0286.127] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000) returned 1 [0286.127] WriteFile (in: hFile=0x450, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0286.127] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x352f898*=0x2000) returned 1 [0286.127] WriteFile (in: hFile=0x450, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0286.128] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0286.128] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0286.128] WriteFile (in: hFile=0x450, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0286.128] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5895020 | out: hHeap=0x310000) returned 1 [0286.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0286.134] CloseHandle (hObject=0x450) returned 1 [0286.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0286.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0286.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0286.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0e48 [0286.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0286.134] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0286.135] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0286.135] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0286.135] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0286.135] GetLastError () returned 0x0 [0286.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0286.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x352f760, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aGphKsS54ZcVf9i", lpUsedDefaultChar=0x0) returned 15 [0286.136] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0286.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0286.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0286.136] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0286.136] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0286.138] WriteFile (in: hFile=0x450, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x352f898*=0xe62, lpOverlapped=0x0) returned 1 [0286.139] CloseHandle (hObject=0x450) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0e48 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0286.139] CryptDestroyKey (hKey=0x5261848) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c952b0 | out: hHeap=0x310000) returned 1 [0286.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2730 | out: hHeap=0x310000) returned 1 [0286.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0286.139] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0286.140] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.140] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0286.192] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.192] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0286.192] CloseHandle (hObject=0x450) returned 1 [0286.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b41b8 [0286.192] RmStartSession () returned 0x0 [0286.195] RmRegisterResources () returned 0x0 [0286.195] RmGetList () returned 0x0 [0289.371] RmShutdown () returned 0x0 [0289.698] RmEndSession () returned 0x0 [0290.032] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261708) returned 1 [0290.032] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0290.032] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF", dwFileAttributes=0x220) returned 1 [0290.032] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0290.032] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0290.032] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=13515) returned 1 [0290.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0290.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5621020 [0290.054] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0290.054] ReadFile (in: hFile=0x450, lpBuffer=0x5621040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x5621040*, lpNumberOfBytesRead=0x352f924*=0x34cb, lpOverlapped=0x0) returned 1 [0290.103] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0290.104] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0290.104] WriteFile (in: hFile=0x450, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0290.104] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0290.104] WriteFile (in: hFile=0x450, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0290.104] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0290.104] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0290.104] WriteFile (in: hFile=0x450, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0290.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5621020 | out: hHeap=0x310000) returned 1 [0290.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0290.109] CloseHandle (hObject=0x450) returned 1 [0290.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0290.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4208 [0290.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4e48 [0290.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4378 [0290.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4208 | out: hHeap=0x310000) returned 1 [0290.110] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0290.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0290.110] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0290.110] GetLastError () returned 0x0 [0290.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0290.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0290.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c1d8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0290.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603eb40 | out: hHeap=0x310000) returned 1 [0290.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0290.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0290.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.111] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0290.112] WriteFile (in: hFile=0x450, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x352f898*=0xe6f, lpOverlapped=0x0) returned 1 [0290.113] CloseHandle (hObject=0x450) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4378 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4e48 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0290.113] CryptDestroyKey (hKey=0x5261708) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c956d8 | out: hHeap=0x310000) returned 1 [0290.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e28c0 | out: hHeap=0x310000) returned 1 [0290.113] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0290.113] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0290.114] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.114] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0290.582] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.582] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0290.582] CloseHandle (hObject=0x450) returned 1 [0290.582] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a57c8 [0290.582] RmStartSession () returned 0x0 [0290.861] RmRegisterResources () returned 0x0 [0290.862] RmGetList () returned 0x0 [0291.089] RmShutdown () returned 0x0 [0291.233] RmEndSession () returned 0x0 [0291.257] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x352fa24 | out: phKey=0x352fa24*=0x5261748) returned 1 [0291.257] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0291.257] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF", dwFileAttributes=0x220) returned 1 [0291.257] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0291.258] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x352f884*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x352f884*=0x2000) returned 1 [0291.258] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x352f91c | out: lpFileSize=0x352f91c*=1696) returned 1 [0291.258] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0291.258] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf0020 [0292.271] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0292.271] ReadFile (in: hFile=0x4f0, lpBuffer=0x4cf0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x4cf0040*, lpNumberOfBytesRead=0x352f924*=0x6a0, lpOverlapped=0x0) returned 1 [0292.271] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f90c | out: lpNewFilePointer=0x0) returned 1 [0292.272] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x352f898*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x352f898*=0x2000) returned 1 [0292.272] WriteFile (in: hFile=0x4f0, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x352f928*=0x2000, lpOverlapped=0x0) returned 1 [0292.309] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f914 | out: lpNewFilePointer=0x0) returned 1 [0292.309] WriteFile (in: hFile=0x4f0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x352f928*=0x200, lpOverlapped=0x0) returned 1 [0292.309] WriteFile (in: hFile=0x4f0, lpBuffer=0x352f8c4*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x352f928, lpOverlapped=0x0 | out: lpBuffer=0x352f8c4*, lpNumberOfBytesWritten=0x352f928*=0x18, lpOverlapped=0x0) returned 1 [0292.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf0020 | out: hHeap=0x310000) returned 1 [0292.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0292.520] CloseHandle (hObject=0x4f0) returned 1 [0292.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0292.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3688 [0292.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6278 [0292.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0292.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3688 | out: hHeap=0x310000) returned 1 [0292.520] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a6310 [0292.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb9b8 [0292.521] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x352f6f8 | out: lpSystemTimeAsFileTime=0x352f6f8) [0292.521] GetLastError () returned 0x0 [0292.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x352f760, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0292.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.522] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0292.523] WriteFile (in: hFile=0x4f0, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x352f898, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x352f898*=0xe56, lpOverlapped=0x0) returned 1 [0292.524] CloseHandle (hObject=0x4f0) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb9b8 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6310 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6278 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0292.524] CryptDestroyKey (hKey=0x5261748) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a57c8 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5270 | out: hHeap=0x310000) returned 1 [0292.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a218 | out: hHeap=0x310000) returned 1 [0292.524] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x352fa58, lpCompletionKey=0x352fa5c, lpOverlapped=0x352fa54) returned 1 [0292.524] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0292.525] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f928 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.525] ReadFile (in: hFile=0x4f0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f924, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f924*=0x18, lpOverlapped=0x0) returned 1 [0292.527] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x352f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.527] ReadFile (in: hFile=0x4f0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x352f918, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x352f918*=0x18, lpOverlapped=0x0) returned 1 [0292.527] CloseHandle (hObject=0x4f0) returned 1 [0292.527] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5270 [0292.527] RmStartSession () returned 0x0 [0293.327] RmRegisterResources () returned 0x0 [0293.331] RmGetList () returned 0x0 [0295.676] RmShutdown () Thread: id = 11 os_tid = 0x10b4 [0068.589] GetLastError () returned 0x57 [0068.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x34bdb8 [0068.590] SetLastError (dwErrCode=0x57) [0068.590] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0069.607] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0128.725] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0131.972] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0133.003] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 0 [0134.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0134.195] CreateFileW (lpFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0134.196] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 0 [0134.196] CloseHandle (hObject=0x4e4) returned 1 [0134.196] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398e80 [0134.196] RmStartSession () returned 0x0 [0134.567] RmRegisterResources () returned 0x0 [0134.583] RmGetList () returned 0x0 [0135.190] RmShutdown () returned 0x0 [0136.282] RmEndSession () returned 0x0 [0137.625] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261188) returned 1 [0137.626] GetFileAttributesW (lpFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 0x22 [0137.626] SetFileAttributesW (lpFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x22) returned 1 [0137.626] CreateFileW (lpFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x538 [0137.626] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0137.626] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=0) returned 1 [0137.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0137.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dc6020 [0137.659] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0137.659] WriteFile (in: hFile=0x538, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0137.660] WriteFile (in: hFile=0x538, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0137.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dc6020 | out: hHeap=0x310000) returned 1 [0137.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0137.665] CloseHandle (hObject=0x538) returned 1 [0137.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0137.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060358 [0137.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0137.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060c48 [0137.667] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060358 | out: hHeap=0x310000) returned 1 [0137.667] MoveFileExW (lpExistingFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), lpNewFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER.bdCDdCBaAd" (normalized: "c:\\$winre_backup_partition.marker.bdcddcbaad"), dwFlags=0x1) returned 1 [0137.667] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5418 [0137.668] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.668] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0137.668] GetLastError () returned 0x0 [0137.668] SetLastError (dwErrCode=0x0) [0137.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0137.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QVBnheip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0137.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QVBnheip", cchWideChar=9, lpMultiByteStr=0x366f740, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2QVBnheip", lpUsedDefaultChar=0x0) returned 9 [0137.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0137.669] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x520b6e0 [0137.669] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980b0 [0137.669] CreateFileW (lpFileName="C:\\\\SxgPNwKy_readme_.txt" (normalized: "c:\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0138.038] WriteFile (in: hFile=0x664, lpBuffer=0x520b6e0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x520b6e0*, lpNumberOfBytesWritten=0x366f87c*=0xe5c, lpOverlapped=0x0) returned 1 [0138.039] CloseHandle (hObject=0x664) returned 1 [0138.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980b0 | out: hHeap=0x310000) returned 1 [0138.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x520b6e0 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5418 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060c48 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0138.429] CryptDestroyKey (hKey=0x5261188) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398e80 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d78 | out: hHeap=0x310000) returned 1 [0138.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a48 | out: hHeap=0x310000) returned 1 [0138.430] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0138.430] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0138.430] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.430] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0138.471] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.471] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0138.472] CloseHandle (hObject=0x670) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060c48 [0138.472] RmStartSession () returned 0x0 [0138.704] RmRegisterResources () returned 0x0 [0138.710] RmGetList () returned 0x0 [0140.622] RmShutdown () returned 0x0 [0141.446] RmEndSession () returned 0x0 [0141.447] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x35d688) returned 1 [0141.447] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0141.447] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.447] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0141.448] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0141.448] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=77232) returned 1 [0141.448] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8570 [0141.448] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dc4020 [0141.857] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0141.857] ReadFile (in: hFile=0x670, lpBuffer=0x4dc4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x4dc4040*, lpNumberOfBytesRead=0x366f908*=0x12db0, lpOverlapped=0x0) returned 1 [0141.861] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0141.861] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.861] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.861] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.862] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.862] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.862] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.862] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.862] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.862] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.863] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.863] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.863] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.863] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.863] CryptEncrypt (in: hKey=0x35d688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0141.863] WriteFile (in: hFile=0x670, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0141.863] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0141.863] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0141.863] WriteFile (in: hFile=0x670, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0141.864] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dc4020 | out: hHeap=0x310000) returned 1 [0142.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8570 | out: hHeap=0x310000) returned 1 [0142.283] CloseHandle (hObject=0x670) returned 1 [0142.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0142.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0142.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0142.286] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0142.286] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0142.286] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1033\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0142.287] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0142.287] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398338 [0142.287] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.287] GetLastError () returned 0x0 [0142.287] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0142.288] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.288] SetLastError (dwErrCode=0x0) [0142.288] GetLastError () returned 0x0 [0142.289] SetLastError (dwErrCode=0x0) [0142.289] GetLastError () returned 0x0 [0142.289] SetLastError (dwErrCode=0x0) [0142.289] GetLastError () returned 0x0 [0142.289] SetLastError (dwErrCode=0x0) [0142.289] GetLastError () returned 0x0 [0142.289] SetLastError (dwErrCode=0x0) [0142.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365a98 [0142.289] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0142.289] GetLastError () returned 0x0 [0142.289] SetLastError (dwErrCode=0x0) [0142.289] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0142.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0142.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0142.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x38c070, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o3YUTB6kWZJFeepfmCEnbwyP1", lpUsedDefaultChar=0x0) returned 25 [0142.289] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a98 | out: hHeap=0x310000) returned 1 [0142.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0142.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5c96138 [0142.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae00 [0142.289] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1033\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0142.290] WriteFile (in: hFile=0x670, lpBuffer=0x5c96138*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x5c96138*, lpNumberOfBytesWritten=0x366f87c*=0xe6c, lpOverlapped=0x0) returned 1 [0142.291] CloseHandle (hObject=0x670) returned 1 [0142.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae00 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c96138 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398338 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0142.292] CryptDestroyKey (hKey=0x35d688) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060c48 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0142.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e80 | out: hHeap=0x310000) returned 1 [0142.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0142.292] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0142.293] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.293] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0142.339] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.339] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0142.339] CloseHandle (hObject=0x670) returned 1 [0142.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3990e8 [0142.339] RmStartSession () returned 0x0 [0142.342] RmRegisterResources () returned 0x0 [0142.346] RmGetList () returned 0x0 [0143.135] RmShutdown () returned 0x0 [0145.715] RmEndSession () returned 0x0 [0145.716] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261348) returned 1 [0145.716] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0145.716] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x80) returned 1 [0145.717] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0145.717] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0145.717] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=3643) returned 1 [0145.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0145.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c2020 [0145.854] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0145.854] ReadFile (in: hFile=0x670, lpBuffer=0x58c2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x58c2040*, lpNumberOfBytesRead=0x366f908*=0xe3b, lpOverlapped=0x0) returned 1 [0145.855] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0145.855] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0145.855] WriteFile (in: hFile=0x670, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0145.855] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0145.855] WriteFile (in: hFile=0x670, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0145.856] WriteFile (in: hFile=0x670, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0145.856] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c2020 | out: hHeap=0x310000) returned 1 [0145.872] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0145.872] CloseHandle (hObject=0x670) returned 1 [0145.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0145.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1bc0 [0145.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398f30 [0145.873] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a23e0 [0145.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1bc0 | out: hHeap=0x310000) returned 1 [0145.873] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1040\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0145.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3996c0 [0145.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980f8 [0145.875] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0145.875] GetLastError () returned 0x0 [0145.875] SetLastError (dwErrCode=0x0) [0145.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0145.875] GetLastError () returned 0x0 [0145.875] SetLastError (dwErrCode=0x0) [0145.875] GetLastError () returned 0x0 [0145.875] SetLastError (dwErrCode=0x0) [0145.875] GetLastError () returned 0x0 [0145.875] SetLastError (dwErrCode=0x0) [0145.875] GetLastError () returned 0x0 [0145.876] SetLastError (dwErrCode=0x0) [0145.876] GetLastError () returned 0x0 [0145.876] SetLastError (dwErrCode=0x0) [0145.876] GetLastError () returned 0x0 [0145.876] SetLastError (dwErrCode=0x0) [0145.876] GetLastError () returned 0x0 [0145.876] SetLastError (dwErrCode=0x0) [0145.876] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0145.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x366f740, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0145.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0145.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0145.876] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0145.876] WriteFile (in: hFile=0x670, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x366f87c*=0xe59, lpOverlapped=0x0) returned 1 [0145.877] CloseHandle (hObject=0x670) returned 1 [0145.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0145.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980f8 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3996c0 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398f30 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0145.878] CryptDestroyKey (hKey=0x5261348) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a30 | out: hHeap=0x310000) returned 1 [0145.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19290 | out: hHeap=0x310000) returned 1 [0145.878] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0145.878] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0145.878] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.878] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0145.891] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.892] ReadFile (in: hFile=0x670, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0145.892] CloseHandle (hObject=0x670) returned 1 [0145.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2240 [0145.892] RmStartSession () returned 0x0 [0145.960] RmRegisterResources () returned 0x0 [0145.966] RmGetList () returned 0x0 [0146.351] RmShutdown () returned 0x0 [0148.744] RmEndSession () returned 0x0 [0148.745] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260e88) returned 1 [0148.745] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0148.745] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0148.745] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0148.745] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0148.745] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=80738) returned 1 [0148.745] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12018 [0148.745] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58ce020 [0148.764] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0148.764] ReadFile (in: hFile=0x680, lpBuffer=0x58ce040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x58ce040*, lpNumberOfBytesRead=0x366f908*=0x13b62, lpOverlapped=0x0) returned 1 [0148.924] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0148.924] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.924] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.924] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.924] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.924] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.924] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.924] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.924] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.924] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.924] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0148.925] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0148.925] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0148.926] WriteFile (in: hFile=0x680, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0148.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58ce020 | out: hHeap=0x310000) returned 1 [0149.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12018 | out: hHeap=0x310000) returned 1 [0149.110] CloseHandle (hObject=0x680) returned 1 [0149.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0149.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0149.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0149.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2d68 [0149.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0149.113] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1046\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0149.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1d60 [0149.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0149.113] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0149.113] GetLastError () returned 0x0 [0149.113] SetLastError (dwErrCode=0x0) [0149.114] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a36f8 [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.114] GetLastError () returned 0x0 [0149.114] SetLastError (dwErrCode=0x0) [0149.115] GetLastError () returned 0x0 [0149.115] SetLastError (dwErrCode=0x0) [0149.115] GetLastError () returned 0x0 [0149.115] SetLastError (dwErrCode=0x0) [0149.115] GetLastError () returned 0x0 [0149.115] SetLastError (dwErrCode=0x0) [0149.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba40 [0149.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0149.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a36f8 | out: hHeap=0x310000) returned 1 [0149.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0149.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x38c160, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JuH0I4bPusHDEdIv", lpUsedDefaultChar=0x0) returned 16 [0149.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0149.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0149.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0149.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39fd0 [0149.115] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1046\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0149.116] WriteFile (in: hFile=0x680, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x366f87c*=0xe63, lpOverlapped=0x0) returned 1 [0149.117] CloseHandle (hObject=0x680) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39fd0 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1d60 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0149.117] CryptDestroyKey (hKey=0x5260e88) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2240 | out: hHeap=0x310000) returned 1 [0149.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392260 | out: hHeap=0x310000) returned 1 [0149.118] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19010 | out: hHeap=0x310000) returned 1 [0149.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0149.118] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0149.118] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.118] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0149.149] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.149] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0149.149] CloseHandle (hObject=0x680) returned 1 [0149.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a23e0 [0149.150] RmStartSession () returned 0x0 [0149.152] RmRegisterResources () returned 0x0 [0149.153] RmGetList () returned 0x0 [0149.612] RmShutdown () returned 0x0 [0150.145] RmEndSession () returned 0x0 [0150.193] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260e48) returned 1 [0150.193] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0150.193] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0150.193] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0150.193] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0150.193] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=79996) returned 1 [0150.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0150.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590a020 [0150.307] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0150.307] ReadFile (in: hFile=0x680, lpBuffer=0x590a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x590a040*, lpNumberOfBytesRead=0x366f908*=0x1387c, lpOverlapped=0x0) returned 1 [0150.361] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0150.361] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.361] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.361] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.361] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.361] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.361] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.361] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.361] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0150.362] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0150.362] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0150.363] WriteFile (in: hFile=0x680, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0150.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590a020 | out: hHeap=0x310000) returned 1 [0150.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0150.375] CloseHandle (hObject=0x680) returned 1 [0150.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0150.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2d68 [0150.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0150.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3120 [0150.378] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0150.378] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\3082\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.379] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1e98 [0150.379] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0150.379] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a31a8 [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.379] GetLastError () returned 0x0 [0150.379] SetLastError (dwErrCode=0x0) [0150.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb58 [0150.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] GetLastError () returned 0x0 [0150.380] SetLastError (dwErrCode=0x0) [0150.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a31a8 | out: hHeap=0x310000) returned 1 [0150.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0150.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0150.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x38c188, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9XOqcHODkUzIb3wxAPZ", lpUsedDefaultChar=0x0) returned 19 [0150.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0150.381] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0150.381] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0150.381] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c399b8 [0150.381] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3082\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0150.383] WriteFile (in: hFile=0x680, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x366f87c*=0xe66, lpOverlapped=0x0) returned 1 [0150.383] CloseHandle (hObject=0x680) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c399b8 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3120 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0150.384] CryptDestroyKey (hKey=0x5260e48) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060a40 | out: hHeap=0x310000) returned 1 [0150.384] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19510 | out: hHeap=0x310000) returned 1 [0150.384] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0150.384] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0150.384] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.385] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0150.455] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.455] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0150.455] CloseHandle (hObject=0x680) returned 1 [0150.455] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39c10 [0150.456] RmStartSession () returned 0x0 [0150.458] RmRegisterResources () returned 0x0 [0150.462] RmGetList () returned 0x0 [0150.643] RmShutdown () returned 0x0 [0152.174] RmEndSession () returned 0x0 [0152.175] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261ac8) returned 1 [0152.175] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0152.175] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0152.175] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0152.175] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0152.175] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=93314) returned 1 [0152.175] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0152.175] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x683a020 [0152.295] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0152.295] ReadFile (in: hFile=0x680, lpBuffer=0x683a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x683a040*, lpNumberOfBytesRead=0x366f908*=0x16c82, lpOverlapped=0x0) returned 1 [0152.298] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0152.298] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.298] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.298] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.298] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.298] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.298] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.298] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.298] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.299] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.299] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.300] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0152.300] WriteFile (in: hFile=0x680, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0152.300] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0152.300] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0152.300] WriteFile (in: hFile=0x680, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0152.300] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x683a020 | out: hHeap=0x310000) returned 1 [0152.349] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0152.349] CloseHandle (hObject=0x680) returned 1 [0152.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0152.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0152.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0152.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0152.352] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0152.352] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0152.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0630 [0152.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3992f8 [0152.352] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0152.352] GetLastError () returned 0x0 [0152.352] SetLastError (dwErrCode=0x0) [0152.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.353] SetLastError (dwErrCode=0x0) [0152.353] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b5a8 [0152.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5351f20 [0152.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b5a8 | out: hHeap=0x310000) returned 1 [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] GetLastError () returned 0x0 [0152.354] SetLastError (dwErrCode=0x0) [0152.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0152.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0152.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0152.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sHbaIgxKQiPPpPi01TvxwcKf8q", cchWideChar=26, lpMultiByteStr=0x38c520, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sHbaIgxKQiPPpPi01TvxwcKf8q", lpUsedDefaultChar=0x0) returned 26 [0152.355] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351f20 | out: hHeap=0x310000) returned 1 [0152.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0152.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0152.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0152.355] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Extended\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0152.355] WriteFile (in: hFile=0x680, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x366f87c*=0xe6d, lpOverlapped=0x0) returned 1 [0152.356] CloseHandle (hObject=0x680) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3992f8 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0630 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0152.356] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0152.357] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0152.357] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39c10 | out: hHeap=0x310000) returned 1 [0152.357] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39aef0 | out: hHeap=0x310000) returned 1 [0152.357] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c196a0 | out: hHeap=0x310000) returned 1 [0152.357] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0152.357] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0152.357] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.357] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0152.379] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.380] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0152.380] CloseHandle (hObject=0x680) returned 1 [0152.380] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0152.380] RmStartSession () returned 0x0 [0152.384] RmRegisterResources () returned 0x0 [0152.387] RmGetList () returned 0x0 [0152.685] RmShutdown () returned 0x0 [0153.607] RmEndSession () returned 0x0 [0154.059] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261408) returned 1 [0154.059] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0154.059] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico", dwFileAttributes=0x80) returned 1 [0154.059] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0154.059] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0154.059] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=1150) returned 1 [0154.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0154.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c9020 [0154.077] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0154.077] ReadFile (in: hFile=0x52c, lpBuffer=0x58c9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x58c9040*, lpNumberOfBytesRead=0x366f908*=0x47e, lpOverlapped=0x0) returned 1 [0154.111] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0154.111] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0154.112] WriteFile (in: hFile=0x52c, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0154.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0154.112] WriteFile (in: hFile=0x52c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0154.112] WriteFile (in: hFile=0x52c, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0154.112] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c9020 | out: hHeap=0x310000) returned 1 [0154.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0154.117] CloseHandle (hObject=0x52c) returned 1 [0154.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0154.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0154.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0154.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0154.118] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0154.118] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0154.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0154.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0154.119] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0154.119] GetLastError () returned 0x0 [0154.119] SetLastError (dwErrCode=0x0) [0154.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0154.119] GetLastError () returned 0x0 [0154.119] SetLastError (dwErrCode=0x0) [0154.119] GetLastError () returned 0x0 [0154.119] SetLastError (dwErrCode=0x0) [0154.119] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0154.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0154.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x366f740, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0154.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0154.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0bd0 [0154.119] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0154.120] WriteFile (in: hFile=0x52c, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x366f87c*=0xe54, lpOverlapped=0x0) returned 1 [0154.121] CloseHandle (hObject=0x52c) returned 1 [0154.121] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0bd0 | out: hHeap=0x310000) returned 1 [0154.121] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0154.121] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0154.121] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0154.121] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0154.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0154.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0154.122] CryptDestroyKey (hKey=0x5261408) returned 1 [0154.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0154.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50605c8 | out: hHeap=0x310000) returned 1 [0154.122] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5ee0 | out: hHeap=0x310000) returned 1 [0154.122] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0154.122] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0154.122] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.122] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0154.200] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.200] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0154.201] CloseHandle (hObject=0x52c) returned 1 [0154.201] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a88 [0154.201] RmStartSession () returned 0x0 [0154.926] RmRegisterResources () returned 0x0 [0154.926] RmGetList () returned 0x0 [0155.460] RmShutdown () returned 0x0 [0157.271] RmEndSession () returned 0x0 [0157.645] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260b48) returned 1 [0157.645] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0157.645] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x80) returned 1 [0157.645] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0157.645] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f884*=0x500000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f884*=0x500000) returned 1 [0157.645] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x366f8d0 | out: lpFileSize=0x366f8d0*=181483595) returned 1 [0157.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x500033) returned 0x65ce020 [0158.544] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0158.544] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0160.007] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0160.007] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0160.013] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0160.294] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x114ec07, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0160.294] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0161.267] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x114ec07, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0161.267] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0161.273] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0161.601] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x229d80e, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0161.601] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0163.166] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x229d80e, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0163.166] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0163.172] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x33ec415, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0163.393] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0164.083] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x33ec415, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0164.083] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0164.089] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0164.529] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x453b01c, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0164.529] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0165.593] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x453b01c, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0165.593] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0165.600] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0166.356] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x5689c23, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0166.356] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0167.095] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x5689c23, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0167.095] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0167.102] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0167.803] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x67d882a, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0167.803] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0168.650] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x67d882a, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0168.651] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0168.657] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0170.557] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x7927431, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0170.557] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0171.158] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x7927431, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0171.158] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0171.164] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0171.486] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x8a76038, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0171.486] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0171.871] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x8a76038, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0171.871] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0171.877] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0172.475] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x9bc4c3f, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0172.475] ReadFile (in: hFile=0x52c, lpBuffer=0x65ce040, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x366f8fc, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesRead=0x366f8fc*=0x500000, lpOverlapped=0x0) returned 1 [0173.860] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x9bc4c3f, lpNewFilePointer=0x0, dwMoveMethod=0x366f8d8 | out: lpNewFilePointer=0x0) returned 1 [0173.860] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000, dwBufLen=0x500000 | out: pbData=0x65ce040*, pdwDataLen=0x366f898*=0x500000) returned 1 [0173.868] WriteFile (in: hFile=0x52c, lpBuffer=0x65ce040*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x65ce040*, lpNumberOfBytesWritten=0x366f8c4*=0x500000, lpOverlapped=0x0) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x52c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f8c4*=0x200, lpOverlapped=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x52c, lpBuffer=0x366f900*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x366f900*, lpNumberOfBytesWritten=0x366f8c4*=0x18, lpOverlapped=0x0) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8c8 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x52c, lpBuffer=0x366f8b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x366f8c4, lpOverlapped=0x0 | out: lpBuffer=0x366f8b8*, lpNumberOfBytesWritten=0x366f8c4*=0x8, lpOverlapped=0x0) returned 1 [0174.350] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65ce020 | out: hHeap=0x310000) returned 1 [0174.977] CloseHandle (hObject=0x52c) returned 1 [0178.106] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0178.106] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f09f0 [0178.106] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c70 [0178.106] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0178.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0178.106] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.bdcddcbaad"), dwFlags=0x1) returned 1 [0178.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399350 [0178.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba40 [0178.107] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.107] GetLastError () returned 0x0 [0178.107] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] GetLastError () returned 0x0 [0178.108] SetLastError (dwErrCode=0x0) [0178.108] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0178.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0178.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x366f740, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cTrvvrwpmgtguVI", lpUsedDefaultChar=0x0) returned 15 [0178.108] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0178.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0178.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0178.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2518 [0178.108] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0178.109] WriteFile (in: hFile=0x52c, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x366f87c*=0xe62, lpOverlapped=0x0) returned 1 [0178.110] CloseHandle (hObject=0x52c) returned 1 [0178.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2518 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399350 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c70 | out: hHeap=0x310000) returned 1 [0178.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0178.111] CryptDestroyKey (hKey=0x5260b48) returned 1 [0179.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a88 | out: hHeap=0x310000) returned 1 [0179.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5368 | out: hHeap=0x310000) returned 1 [0179.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5b20 | out: hHeap=0x310000) returned 1 [0179.531] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0179.531] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0179.531] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.531] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0179.572] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.572] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0179.572] CloseHandle (hObject=0x5c0) returned 1 [0179.572] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0450 [0179.572] RmStartSession () returned 0x0 [0179.633] RmRegisterResources () returned 0x0 [0179.638] RmGetList () returned 0x0 [0180.018] RmShutdown () returned 0x0 [0182.122] RmEndSession () returned 0x0 [0182.123] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261948) returned 1 [0182.123] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0182.123] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0182.123] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0182.123] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0182.123] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=69632) returned 1 [0182.123] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5411c60 [0182.124] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b5020 [0182.558] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0182.558] ReadFile (in: hFile=0x5c0, lpBuffer=0x64b5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x64b5040*, lpNumberOfBytesRead=0x366f908*=0x11000, lpOverlapped=0x0) returned 1 [0182.560] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0182.560] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.560] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.561] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.561] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.561] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.561] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.561] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.561] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.561] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.561] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.561] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.561] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.562] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.562] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.562] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.562] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.562] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0182.562] WriteFile (in: hFile=0x5c0, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0182.562] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0182.562] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0182.563] WriteFile (in: hFile=0x5c0, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0182.563] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b5020 | out: hHeap=0x310000) returned 1 [0185.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5411c60 | out: hHeap=0x310000) returned 1 [0185.659] CloseHandle (hObject=0x5c0) returned 1 [0185.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0185.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0185.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0180 [0185.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0185.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0185.662] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0185.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0185.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0185.663] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] GetLastError () returned 0x0 [0185.663] SetLastError (dwErrCode=0x0) [0185.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0185.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0185.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7L6vG", cchWideChar=5, lpMultiByteStr=0x366f740, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7L6vG", lpUsedDefaultChar=0x0) returned 5 [0185.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0185.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0185.663] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0185.664] WriteFile (in: hFile=0x5c0, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x366f87c*=0xe58, lpOverlapped=0x0) returned 1 [0185.665] CloseHandle (hObject=0x5c0) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0180 | out: hHeap=0x310000) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0185.665] CryptDestroyKey (hKey=0x5261948) returned 1 [0185.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0450 | out: hHeap=0x310000) returned 1 [0185.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39afe0 | out: hHeap=0x310000) returned 1 [0185.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6c90 | out: hHeap=0x310000) returned 1 [0185.666] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0185.666] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0185.666] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.666] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0185.667] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.668] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0185.668] CloseHandle (hObject=0x5c0) returned 1 [0185.668] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0185.668] RmStartSession () returned 0x0 [0185.669] RmRegisterResources () returned 0x0 [0185.673] RmGetList () returned 0x0 [0185.970] RmShutdown () returned 0x0 [0188.632] RmEndSession () returned 0x0 [0188.633] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260b48) returned 1 [0188.633] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0188.633] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0188.633] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0188.633] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0188.633] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=69632) returned 1 [0188.633] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd4050 [0188.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e6020 [0189.062] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0189.062] ReadFile (in: hFile=0x5c0, lpBuffer=0x49e6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x49e6040*, lpNumberOfBytesRead=0x366f908*=0x11000, lpOverlapped=0x0) returned 1 [0189.064] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.064] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.064] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.065] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.065] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.065] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.065] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.065] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd4060*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0189.065] WriteFile (in: hFile=0x5c0, lpBuffer=0x5bd4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bd4060*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0189.065] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0189.065] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0189.065] WriteFile (in: hFile=0x5c0, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0189.066] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e6020 | out: hHeap=0x310000) returned 1 [0189.842] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd4050 | out: hHeap=0x310000) returned 1 [0189.842] CloseHandle (hObject=0x5c0) returned 1 [0189.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0189.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0189.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0720 [0189.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5323110 [0189.845] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0189.845] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0189.845] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0189.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0189.846] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.846] SetLastError (dwErrCode=0x0) [0189.846] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b490 [0189.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] GetLastError () returned 0x0 [0189.847] SetLastError (dwErrCode=0x0) [0189.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0189.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0189.847] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x38c3b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tRdDQltWN4PVKdRqXUoqyy", lpUsedDefaultChar=0x0) returned 22 [0189.847] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0189.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540d6a0 [0189.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540ab08 [0189.848] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397528 [0189.848] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0189.849] WriteFile (in: hFile=0x5c0, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x366f87c*=0xe69, lpOverlapped=0x0) returned 1 [0189.849] CloseHandle (hObject=0x5c0) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5323110 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 [0189.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0189.851] CryptDestroyKey (hKey=0x5260b48) returned 1 [0189.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0189.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0189.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365b38 | out: hHeap=0x310000) returned 1 [0189.851] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0189.851] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0189.851] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.851] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0189.884] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.884] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0189.884] CloseHandle (hObject=0x5c0) returned 1 [0189.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0189.885] RmStartSession () returned 0x0 [0189.944] RmRegisterResources () returned 0x0 [0189.949] RmGetList () returned 0x0 [0191.659] RmShutdown () returned 0x0 [0193.436] RmEndSession () returned 0x0 [0193.437] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261948) returned 1 [0193.437] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0193.437] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0193.437] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0193.437] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0193.437] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=69632) returned 1 [0193.437] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x60b6098 [0193.438] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6216020 [0193.800] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0193.800] ReadFile (in: hFile=0x5c0, lpBuffer=0x6216040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x6216040*, lpNumberOfBytesRead=0x366f908*=0x11000, lpOverlapped=0x0) returned 1 [0193.802] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0193.802] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.802] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.802] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.802] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.802] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.802] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.802] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.802] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.802] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.803] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.803] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.803] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.803] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x60b60a0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x60b60a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x60b60a0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0193.803] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0193.803] WriteFile (in: hFile=0x5c0, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0193.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6216020 | out: hHeap=0x310000) returned 1 [0193.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60b6098 | out: hHeap=0x310000) returned 1 [0193.950] CloseHandle (hObject=0x5c0) returned 1 [0193.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0193.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5354ed8 [0193.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0193.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53558b0 [0193.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5354ed8 | out: hHeap=0x310000) returned 1 [0193.950] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0193.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0193.953] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0193.953] GetLastError () returned 0x0 [0193.953] SetLastError (dwErrCode=0x0) [0193.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0193.953] GetLastError () returned 0x0 [0193.953] SetLastError (dwErrCode=0x0) [0193.953] GetLastError () returned 0x0 [0193.954] SetLastError (dwErrCode=0x0) [0193.954] GetLastError () returned 0x0 [0193.954] SetLastError (dwErrCode=0x0) [0193.954] GetLastError () returned 0x0 [0193.954] SetLastError (dwErrCode=0x0) [0193.954] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0193.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x366f740, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwY", lpUsedDefaultChar=0x0) returned 3 [0193.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540c818 [0193.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c78 [0193.954] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0193.955] WriteFile (in: hFile=0x5c0, lpBuffer=0x540c818*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x540c818*, lpNumberOfBytesWritten=0x366f87c*=0xe56, lpOverlapped=0x0) returned 1 [0193.956] CloseHandle (hObject=0x5c0) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c78 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540c818 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53558b0 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0193.956] CryptDestroyKey (hKey=0x5261948) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea830 | out: hHeap=0x310000) returned 1 [0193.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44ad8 | out: hHeap=0x310000) returned 1 [0193.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0193.957] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0193.968] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.968] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.972] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0193.972] CloseHandle (hObject=0x640) returned 1 [0193.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0193.972] RmStartSession () returned 0x0 [0194.220] RmRegisterResources () returned 0x0 [0194.224] RmGetList () returned 0x0 [0195.110] RmShutdown () returned 0x0 [0198.113] RmEndSession () returned 0x0 [0198.114] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260e48) returned 1 [0198.114] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0198.114] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", dwFileAttributes=0x20) returned 0 [0198.115] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.115] CryptDestroyKey (hKey=0x5260e48) returned 1 [0198.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0198.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c9a0 | out: hHeap=0x310000) returned 1 [0198.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44808 | out: hHeap=0x310000) returned 1 [0198.115] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0198.115] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0198.115] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.115] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0198.118] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.118] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0198.118] CloseHandle (hObject=0x640) returned 1 [0198.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b7ec38 [0198.118] RmStartSession () returned 0x0 [0198.121] RmRegisterResources () returned 0x0 [0198.121] RmGetList () returned 0x0 [0200.487] RmShutdown () returned 0x0 [0204.007] RmEndSession () returned 0x0 [0204.451] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260f08) returned 1 [0204.451] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0204.451] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui", dwFileAttributes=0x20) returned 0 [0204.451] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.452] CryptDestroyKey (hKey=0x5260f08) returned 1 [0204.452] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7ec38 | out: hHeap=0x310000) returned 1 [0204.452] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390bc8 | out: hHeap=0x310000) returned 1 [0204.452] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08370 | out: hHeap=0x310000) returned 1 [0204.452] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0204.452] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0204.452] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.452] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0204.460] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.460] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0204.460] CloseHandle (hObject=0x4fc) returned 1 [0204.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92f58 [0204.460] RmStartSession () returned 0x0 [0204.461] RmRegisterResources () returned 0x0 [0204.466] RmGetList () returned 0x0 [0205.434] RmShutdown () returned 0x0 [0208.468] RmEndSession () returned 0x0 [0208.926] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260e48) returned 1 [0208.926] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0208.926] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0208.926] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.926] CryptDestroyKey (hKey=0x5260e48) returned 1 [0208.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92f58 | out: hHeap=0x310000) returned 1 [0208.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92a18 | out: hHeap=0x310000) returned 1 [0208.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08190 | out: hHeap=0x310000) returned 1 [0208.926] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0208.926] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0208.929] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.929] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0208.990] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.990] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0208.990] CloseHandle (hObject=0x558) returned 1 [0208.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53eb260 [0208.990] RmStartSession () returned 0x0 [0208.992] RmRegisterResources () returned 0x0 [0208.992] RmGetList () returned 0x0 [0209.359] RmShutdown () returned 0x0 [0209.770] RmEndSession () returned 0x0 [0209.771] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261548) returned 1 [0209.771] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0209.771] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", dwFileAttributes=0x20) returned 0 [0209.772] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.772] CryptDestroyKey (hKey=0x5261548) returned 1 [0209.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53eb260 | out: hHeap=0x310000) returned 1 [0209.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0209.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5a60 | out: hHeap=0x310000) returned 1 [0209.772] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0209.772] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0209.772] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.772] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0209.773] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.773] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0209.773] CloseHandle (hObject=0x558) returned 1 [0209.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390c80 [0209.774] RmStartSession () returned 0x0 [0209.775] RmRegisterResources () returned 0x0 [0209.776] RmGetList () returned 0x0 [0210.623] RmShutdown () returned 0x0 [0211.434] RmEndSession () returned 0x0 [0211.434] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x35d708) returned 1 [0211.435] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0211.435] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", dwFileAttributes=0x20) returned 0 [0211.435] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.435] CryptDestroyKey (hKey=0x35d708) returned 1 [0211.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390c80 | out: hHeap=0x310000) returned 1 [0211.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0211.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5c40 | out: hHeap=0x310000) returned 1 [0211.435] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0211.435] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0211.435] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.435] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0211.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.437] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0211.437] CloseHandle (hObject=0x558) returned 1 [0211.438] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390778 [0211.438] RmStartSession () returned 0x0 [0211.440] RmRegisterResources () returned 0x0 [0211.918] RmGetList () returned 0x0 [0212.901] RmShutdown () returned 0x0 [0214.140] RmEndSession () returned 0x0 [0214.140] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261a88) returned 1 [0214.140] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0214.140] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", dwFileAttributes=0x20) returned 0 [0214.141] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.141] CryptDestroyKey (hKey=0x5261a88) returned 1 [0214.141] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390778 | out: hHeap=0x310000) returned 1 [0214.141] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0214.141] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5ab0 | out: hHeap=0x310000) returned 1 [0214.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0214.141] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0214.212] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.212] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0214.291] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.292] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0214.292] CloseHandle (hObject=0x69c) returned 1 [0214.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd5c0 [0214.292] RmStartSession () returned 0x0 [0214.295] RmRegisterResources () returned 0x0 [0214.299] RmGetList () returned 0x0 [0215.464] RmShutdown () returned 0x0 [0218.171] RmEndSession () returned 0x0 [0218.172] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261648) returned 1 [0218.172] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0218.172] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml", dwFileAttributes=0x20) returned 0 [0218.172] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.172] CryptDestroyKey (hKey=0x5261648) returned 1 [0218.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd5c0 | out: hHeap=0x310000) returned 1 [0218.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb358 | out: hHeap=0x310000) returned 1 [0218.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6000 | out: hHeap=0x310000) returned 1 [0218.173] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0218.173] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0218.173] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.173] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0218.176] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.176] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0218.176] CloseHandle (hObject=0x69c) returned 1 [0218.176] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd5c0 [0218.176] RmStartSession () returned 0x0 [0218.178] RmRegisterResources () returned 0x0 [0218.179] RmGetList () returned 0x0 [0218.926] RmShutdown () returned 0x0 [0219.529] RmEndSession () returned 0x0 [0219.684] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261988) returned 1 [0219.684] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0219.684] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml", dwFileAttributes=0x20) returned 0 [0219.684] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.684] CryptDestroyKey (hKey=0x5261988) returned 1 [0219.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd5c0 | out: hHeap=0x310000) returned 1 [0219.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebce8 | out: hHeap=0x310000) returned 1 [0219.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5f10 | out: hHeap=0x310000) returned 1 [0219.684] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0219.684] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0219.684] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.684] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0219.845] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.845] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0219.846] CloseHandle (hObject=0x69c) returned 1 [0219.846] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5f80 [0219.846] RmStartSession () returned 0x0 [0219.999] RmRegisterResources () returned 0x0 [0220.000] RmGetList () returned 0x0 [0220.078] RmShutdown () returned 0x0 [0222.269] RmEndSession () returned 0x0 [0222.319] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261348) returned 1 [0222.319] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0222.319] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0222.319] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.319] CryptDestroyKey (hKey=0x5261348) returned 1 [0222.319] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5f80 | out: hHeap=0x310000) returned 1 [0222.319] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0222.319] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14650 | out: hHeap=0x310000) returned 1 [0222.319] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0222.319] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0222.320] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.320] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0222.345] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.345] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0222.345] CloseHandle (hObject=0x69c) returned 1 [0222.345] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0222.345] RmStartSession () returned 0x0 [0222.347] RmRegisterResources () returned 0x0 [0222.347] RmGetList () returned 0x0 [0222.483] RmShutdown () returned 0x0 [0223.282] RmEndSession () returned 0x0 [0223.283] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x52617c8) returned 1 [0223.283] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0223.283] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0223.283] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.284] CryptDestroyKey (hKey=0x52617c8) returned 1 [0223.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0223.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef308 | out: hHeap=0x310000) returned 1 [0223.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c145b0 | out: hHeap=0x310000) returned 1 [0223.284] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0223.284] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0223.284] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.284] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0223.288] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.288] ReadFile (in: hFile=0x69c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0223.288] CloseHandle (hObject=0x69c) returned 1 [0223.288] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0223.288] RmStartSession () returned 0x0 [0223.291] RmRegisterResources () returned 0x0 [0223.687] RmGetList () returned 0x0 [0224.384] RmShutdown () returned 0x0 [0224.937] RmEndSession () returned 0x0 [0225.608] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260bc8) returned 1 [0225.608] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0225.608] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.608] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.608] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0225.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0225.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3edeb0 | out: hHeap=0x310000) returned 1 [0225.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14920 | out: hHeap=0x310000) returned 1 [0225.608] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0225.608] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0225.615] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.615] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0225.623] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.623] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0225.623] CloseHandle (hObject=0x484) returned 1 [0225.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0225.624] RmStartSession () returned 0x0 [0225.962] RmRegisterResources () returned 0x0 [0225.963] RmGetList () returned 0x0 [0226.739] RmShutdown () returned 0x0 [0227.611] RmEndSession () returned 0x0 [0228.447] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260cc8) returned 1 [0228.447] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0228.447] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", dwFileAttributes=0x20) returned 0 [0228.447] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.468] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0228.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0228.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c448 | out: hHeap=0x310000) returned 1 [0228.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14790 | out: hHeap=0x310000) returned 1 [0228.468] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0228.468] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec [0228.502] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.502] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0228.548] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.548] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0228.548] CloseHandle (hObject=0x5ec) returned 1 [0228.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0228.548] RmStartSession () returned 0x0 [0228.551] RmRegisterResources () returned 0x0 [0228.551] RmGetList () returned 0x0 [0228.791] RmShutdown () returned 0x0 [0229.738] RmEndSession () returned 0x0 [0229.814] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261348) returned 1 [0229.815] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0229.815] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x20) returned 0 [0229.815] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.815] CryptDestroyKey (hKey=0x5261348) returned 1 [0229.815] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0229.815] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571d60 | out: hHeap=0x310000) returned 1 [0229.815] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14f60 | out: hHeap=0x310000) returned 1 [0229.815] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0229.815] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec [0229.815] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.815] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0229.819] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.819] ReadFile (in: hFile=0x5ec, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0229.819] CloseHandle (hObject=0x5ec) returned 1 [0229.820] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0720 [0229.820] RmStartSession () returned 0x0 [0230.047] RmRegisterResources () returned 0x0 [0230.047] RmGetList () returned 0x0 [0230.275] RmShutdown () returned 0x0 [0232.817] RmEndSession () returned 0x0 [0232.976] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x52610c8) returned 1 [0232.976] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0232.976] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado21.tlb", dwFileAttributes=0x20) returned 0 [0232.976] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.976] CryptDestroyKey (hKey=0x52610c8) returned 1 [0232.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 [0232.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0232.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18d40 | out: hHeap=0x310000) returned 1 [0232.976] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0232.976] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0232.977] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.977] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0232.986] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.986] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0232.987] CloseHandle (hObject=0x500) returned 1 [0232.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0232.987] RmStartSession () returned 0x0 [0233.047] RmRegisterResources () returned 0x0 [0233.048] RmGetList () returned 0x0 [0233.136] RmShutdown () returned 0x0 [0234.060] RmEndSession () returned 0x0 [0234.061] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261708) returned 1 [0234.061] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0234.061] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", dwFileAttributes=0x20) returned 0 [0234.061] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.061] CryptDestroyKey (hKey=0x5261708) returned 1 [0234.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0234.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571b98 | out: hHeap=0x310000) returned 1 [0234.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572b08 | out: hHeap=0x310000) returned 1 [0234.062] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0234.062] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0234.062] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.062] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0234.098] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.098] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0234.098] CloseHandle (hObject=0x554) returned 1 [0234.098] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0234.098] RmStartSession () returned 0x0 [0234.101] RmRegisterResources () returned 0x0 [0234.106] RmGetList () returned 0x0 [0235.574] RmShutdown () returned 0x0 [0237.673] RmEndSession () returned 0x0 [0237.850] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260f08) returned 1 [0237.850] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0237.850] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui", dwFileAttributes=0x20) returned 0 [0237.850] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.850] CryptDestroyKey (hKey=0x5260f08) returned 1 [0237.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0237.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2c58 | out: hHeap=0x310000) returned 1 [0237.850] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572dd8 | out: hHeap=0x310000) returned 1 [0237.851] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0237.851] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0237.851] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.851] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0237.874] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.874] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0237.931] CloseHandle (hObject=0x554) returned 1 [0237.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19a38 [0237.931] RmStartSession () returned 0x0 [0237.934] RmRegisterResources () returned 0x0 [0237.938] RmGetList () returned 0x0 [0238.769] RmShutdown () returned 0x0 [0240.693] RmEndSession () returned 0x0 [0240.693] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x52618c8) returned 1 [0240.694] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0240.694] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data", dwFileAttributes=0x20) returned 1 [0240.694] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0240.694] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0240.694] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=4122) returned 1 [0240.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5efb0 [0240.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57d2020 [0241.087] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0241.087] ReadFile (in: hFile=0x554, lpBuffer=0x57d2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x57d2040*, lpNumberOfBytesRead=0x366f908*=0x101a, lpOverlapped=0x0) returned 1 [0241.088] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0241.088] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5efc0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5efc0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0241.089] WriteFile (in: hFile=0x554, lpBuffer=0x4b5efc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4b5efc0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0241.089] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0241.089] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0241.089] WriteFile (in: hFile=0x554, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0241.089] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57d2020 | out: hHeap=0x310000) returned 1 [0241.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5efb0 | out: hHeap=0x310000) returned 1 [0241.547] CloseHandle (hObject=0x554) returned 1 [0241.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0241.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0241.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0241.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0241.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0241.547] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.bdcddcbaad"), dwFlags=0x1) returned 1 [0241.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ab0 [0241.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0241.549] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.550] SetLastError (dwErrCode=0x0) [0241.550] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0241.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x52e5ca0 [0241.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0241.551] GetLastError () returned 0x0 [0241.551] SetLastError (dwErrCode=0x0) [0241.551] GetLastError () returned 0x0 [0241.552] SetLastError (dwErrCode=0x0) [0241.552] GetLastError () returned 0x0 [0241.552] SetLastError (dwErrCode=0x0) [0241.552] GetLastError () returned 0x0 [0241.552] SetLastError (dwErrCode=0x0) [0241.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0241.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0241.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0241.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x38c390, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", lpUsedDefaultChar=0x0) returned 28 [0241.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e5ca0 | out: hHeap=0x310000) returned 1 [0241.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0241.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0241.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0241.552] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0241.553] WriteFile (in: hFile=0x554, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x366f87c*=0xe6f, lpOverlapped=0x0) returned 1 [0241.553] CloseHandle (hObject=0x554) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ab0 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0241.554] CryptDestroyKey (hKey=0x52618c8) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19a38 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39f58 | out: hHeap=0x310000) returned 1 [0241.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572298 | out: hHeap=0x310000) returned 1 [0241.554] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0241.554] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0241.581] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.581] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0241.583] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.583] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0241.583] CloseHandle (hObject=0x450) returned 1 [0241.583] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0241.583] RmStartSession () returned 0x0 [0242.033] RmRegisterResources () returned 0x0 [0242.037] RmGetList () returned 0x0 [0242.974] RmShutdown () returned 0x0 [0244.276] RmEndSession () returned 0x0 [0244.277] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261ac8) returned 1 [0244.277] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0244.277] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", dwFileAttributes=0x20) returned 1 [0244.277] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0244.277] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0244.277] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=188024) returned 1 [0244.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0244.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c27020 [0244.920] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.920] SetLastError (dwErrCode=0x0) [0244.920] GetLastError () returned 0x0 [0244.921] SetLastError (dwErrCode=0x0) [0244.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0244.921] GetLastError () returned 0x0 [0244.921] SetLastError (dwErrCode=0x0) [0244.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0244.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0244.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x366f740, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0244.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0244.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0244.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0244.921] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0244.922] WriteFile (in: hFile=0x450, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x366f87c*=0xe5c, lpOverlapped=0x0) returned 1 [0244.923] CloseHandle (hObject=0x450) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0244.923] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570800 | out: hHeap=0x310000) returned 1 [0244.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352880 | out: hHeap=0x310000) returned 1 [0244.923] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0244.923] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0244.924] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.924] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0244.935] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.935] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0244.935] CloseHandle (hObject=0x450) returned 1 [0244.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0244.935] RmStartSession () returned 0x0 [0244.936] RmRegisterResources () returned 0x0 [0244.937] RmGetList () returned 0x0 [0244.984] RmShutdown () returned 0x0 [0245.769] RmEndSession () returned 0x0 [0245.770] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261708) returned 1 [0245.770] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0245.770] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf", dwFileAttributes=0x20) returned 1 [0245.771] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0245.771] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0245.771] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=75144) returned 1 [0245.771] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0245.771] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x791e020 [0246.824] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0246.824] GetLastError () returned 0x0 [0246.824] SetLastError (dwErrCode=0x0) [0246.824] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.825] SetLastError (dwErrCode=0x0) [0246.825] GetLastError () returned 0x0 [0246.826] SetLastError (dwErrCode=0x0) [0246.826] GetLastError () returned 0x0 [0246.826] SetLastError (dwErrCode=0x0) [0246.826] GetLastError () returned 0x0 [0246.826] SetLastError (dwErrCode=0x0) [0246.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b8b8 [0246.826] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0246.826] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0246.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0246.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0246.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c3b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0246.826] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0246.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0246.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0246.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0246.826] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0246.826] WriteFile (in: hFile=0x450, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x366f87c*=0xe63, lpOverlapped=0x0) returned 1 [0246.827] CloseHandle (hObject=0x450) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0246.828] CryptDestroyKey (hKey=0x5261708) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55709c8 | out: hHeap=0x310000) returned 1 [0246.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352470 | out: hHeap=0x310000) returned 1 [0246.828] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0246.828] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0246.829] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.829] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0246.853] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.853] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0246.853] CloseHandle (hObject=0x450) returned 1 [0246.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0246.853] RmStartSession () returned 0x0 [0246.855] RmRegisterResources () returned 0x0 [0246.855] RmGetList () returned 0x0 [0247.998] RmShutdown () returned 0x0 [0249.094] RmEndSession () returned 0x0 [0249.335] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260cc8) returned 1 [0249.335] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0249.336] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties", dwFileAttributes=0x20) returned 1 [0249.336] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0249.336] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0249.336] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=1280) returned 1 [0249.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54b7e48 [0249.336] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c24020 [0249.403] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.404] SetLastError (dwErrCode=0x0) [0249.404] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0249.405] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] SetLastError (dwErrCode=0x0) [0249.405] GetLastError () returned 0x0 [0249.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0249.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c4d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.405] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0249.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0249.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0249.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0249.405] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0249.406] WriteFile (in: hFile=0x450, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x366f87c*=0xe69, lpOverlapped=0x0) returned 1 [0249.407] CloseHandle (hObject=0x450) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19fd8 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0249.407] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eee70 | out: hHeap=0x310000) returned 1 [0249.407] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53527e0 | out: hHeap=0x310000) returned 1 [0249.407] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0249.408] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0249.408] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.408] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0249.440] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.440] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0249.440] CloseHandle (hObject=0x450) returned 1 [0249.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0249.440] RmStartSession () returned 0x0 [0249.872] RmRegisterResources () returned 0x0 [0249.872] RmGetList () returned 0x0 [0249.965] RmShutdown () returned 0x0 [0250.640] RmEndSession () returned 0x0 [0250.641] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x52610c8) returned 1 [0250.641] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0250.641] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", dwFileAttributes=0x20) returned 1 [0250.641] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0250.641] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0250.641] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=560581) returned 1 [0250.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0250.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x580b020 [0251.104] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0251.105] ReadFile (in: hFile=0x5dc, lpBuffer=0x580b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x580b040*, lpNumberOfBytesRead=0x366f908*=0x88dc5, lpOverlapped=0x0) returned 1 [0251.110] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0251.110] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.110] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.110] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.110] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.111] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.111] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.112] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.112] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.113] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.113] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.114] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.114] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.115] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.115] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.116] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.116] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.117] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.117] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.118] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.118] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.119] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.119] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.120] CryptEncrypt (in: hKey=0x52610c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0251.120] WriteFile (in: hFile=0x5dc, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0251.120] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0251.120] WriteFile (in: hFile=0x5dc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0251.120] WriteFile (in: hFile=0x5dc, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0251.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x580b020 | out: hHeap=0x310000) returned 1 [0251.515] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5485030 | out: hHeap=0x310000) returned 1 [0251.515] CloseHandle (hObject=0x5dc) returned 1 [0251.515] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0251.515] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0251.515] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0251.515] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0251.515] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0251.515] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0251.516] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0251.516] GetLastError () returned 0x0 [0251.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0251.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c098, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f29c0 | out: hHeap=0x310000) returned 1 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e7eb0 [0251.516] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0251.516] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0251.517] WriteFile (in: hFile=0x5dc, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x366f87c*=0xe70, lpOverlapped=0x0) returned 1 [0251.518] CloseHandle (hObject=0x5dc) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0251.518] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0251.518] CryptDestroyKey (hKey=0x52610c8) returned 1 [0251.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0251.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0251.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352c40 | out: hHeap=0x310000) returned 1 [0251.519] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0251.519] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0251.519] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.519] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0251.520] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.521] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0251.521] CloseHandle (hObject=0x5dc) returned 1 [0251.521] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0251.521] RmStartSession () returned 0x0 [0251.523] RmRegisterResources () returned 0x0 [0251.527] RmGetList () returned 0x0 [0253.540] RmShutdown () returned 0x0 [0255.142] RmEndSession () returned 0x0 [0255.143] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260d88) returned 1 [0255.143] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0255.143] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja", dwFileAttributes=0x20) returned 1 [0255.143] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0255.143] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0255.143] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=2796) returned 1 [0255.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5f14028 [0255.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7bd7020 [0255.820] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0255.820] ReadFile (in: hFile=0x5dc, lpBuffer=0x7bd7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x7bd7040*, lpNumberOfBytesRead=0x366f908*=0xaec, lpOverlapped=0x0) returned 1 [0255.821] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0255.821] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f14040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f14040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0255.821] WriteFile (in: hFile=0x5dc, lpBuffer=0x5f14040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5f14040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0255.821] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0255.821] WriteFile (in: hFile=0x5dc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0255.822] WriteFile (in: hFile=0x5dc, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0255.822] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7bd7020 | out: hHeap=0x310000) returned 1 [0257.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f14028 | out: hHeap=0x310000) returned 1 [0257.431] CloseHandle (hObject=0x5dc) returned 1 [0257.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0257.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0257.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0257.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0257.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0257.431] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.bdcddcbaad"), dwFlags=0x1) returned 1 [0257.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0257.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0257.432] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0257.432] GetLastError () returned 0x0 [0257.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0257.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0257.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lhFmgbd9gk01UGhCZ", cchWideChar=17, lpMultiByteStr=0x38c0c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lhFmgbd9gk01UGhCZ", lpUsedDefaultChar=0x0) returned 17 [0257.432] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0257.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0257.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0257.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0257.433] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0257.433] WriteFile (in: hFile=0x5dc, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x366f87c*=0xe64, lpOverlapped=0x0) returned 1 [0257.434] CloseHandle (hObject=0x5dc) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0257.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0257.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0257.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0257.435] CryptDestroyKey (hKey=0x5260d88) returned 1 [0257.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0257.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a35e8 | out: hHeap=0x310000) returned 1 [0257.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352c90 | out: hHeap=0x310000) returned 1 [0257.435] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0257.435] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0257.435] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.435] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0257.437] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.437] ReadFile (in: hFile=0x5dc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0257.437] CloseHandle (hObject=0x5dc) returned 1 [0257.437] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c90 [0257.437] RmStartSession () returned 0x0 [0257.439] RmRegisterResources () returned 0x0 [0257.442] RmGetList () returned 0x0 [0258.290] RmShutdown () returned 0x0 [0259.926] RmEndSession () returned 0x0 [0259.929] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260f08) returned 1 [0259.929] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0259.929] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML", dwFileAttributes=0x20) returned 1 [0259.929] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0259.929] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0259.929] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=36336) returned 1 [0259.929] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0259.930] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3b020 [0260.008] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0260.008] WriteFile (in: hFile=0x5dc, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0260.009] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0260.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0260.009] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0260.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0260.009] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0260.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0260.009] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bae040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0260.009] WriteFile (in: hFile=0x5dc, lpBuffer=0x5bae040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5bae040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0260.009] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0260.010] WriteFile (in: hFile=0x5dc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0260.010] WriteFile (in: hFile=0x5dc, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0260.010] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d3b020 | out: hHeap=0x310000) returned 1 [0260.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bae030 | out: hHeap=0x310000) returned 1 [0260.015] CloseHandle (hObject=0x5dc) returned 1 [0260.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0260.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0260.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0260.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0260.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0260.015] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19e70 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0260.016] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0260.016] GetLastError () returned 0x0 [0260.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0260.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x38c390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", lpUsedDefaultChar=0x0) returned 26 [0260.016] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x610ed20 | out: hHeap=0x310000) returned 1 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0260.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0260.016] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\Office16\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\office16\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0260.017] WriteFile (in: hFile=0x5dc, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x366f87c*=0xe6d, lpOverlapped=0x0) returned 1 [0260.018] CloseHandle (hObject=0x5dc) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0260.018] CryptDestroyKey (hKey=0x5260f08) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c90 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0d38 | out: hHeap=0x310000) returned 1 [0260.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351a70 | out: hHeap=0x310000) returned 1 [0260.018] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0260.018] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0260.319] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.319] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0260.321] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.321] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0260.321] CloseHandle (hObject=0x650) returned 1 [0260.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f05610 [0260.321] RmStartSession () returned 0x0 [0260.769] RmRegisterResources () returned 0x0 [0260.773] RmGetList () returned 0x0 [0261.911] RmShutdown () returned 0x0 [0264.135] RmEndSession () returned 0x0 [0264.558] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261488) returned 1 [0264.559] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0264.559] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.559] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0264.559] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0264.559] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=763363) returned 1 [0264.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0264.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e0020 [0265.004] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0265.004] GetLastError () returned 0x0 [0265.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cA59qhRcQfh", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0265.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cA59qhRcQfh", cchWideChar=11, lpMultiByteStr=0x366f740, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cA59qhRcQfh", lpUsedDefaultChar=0x0) returned 11 [0265.016] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0265.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0265.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0265.016] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0265.017] WriteFile (in: hFile=0x5c0, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x366f87c*=0xe5e, lpOverlapped=0x0) returned 1 [0265.017] CloseHandle (hObject=0x5c0) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04878 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5399c18 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f058c8 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0265.018] CryptDestroyKey (hKey=0x5261488) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f05610 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa3c8 | out: hHeap=0x310000) returned 1 [0265.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351a20 | out: hHeap=0x310000) returned 1 [0265.018] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0265.018] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0265.018] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.018] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0265.052] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.053] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0265.053] CloseHandle (hObject=0x5c0) returned 1 [0265.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f058c8 [0265.053] RmStartSession () returned 0x0 [0265.054] RmRegisterResources () returned 0x0 [0265.054] RmGetList () returned 0x0 [0265.077] RmShutdown () returned 0x0 [0266.245] RmEndSession () returned 0x0 [0266.246] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261408) returned 1 [0266.246] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0266.246] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0266.247] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0266.247] CryptEncrypt (in: hKey=0x5261408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0266.247] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=1261) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c150d8 [0266.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7d1a020 [0267.471] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0267.471] GetLastError () returned 0x0 [0267.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0267.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0267.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pvosW60j6t7if2aYH", cchWideChar=17, lpMultiByteStr=0x38c390, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pvosW60j6t7if2aYH", lpUsedDefaultChar=0x0) returned 17 [0267.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0267.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0267.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0267.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0267.472] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0267.472] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x366f87c*=0xe64, lpOverlapped=0x0) returned 1 [0267.473] CloseHandle (hObject=0x5c0) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a07a0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0267.474] CryptDestroyKey (hKey=0x5261408) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f058c8 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5347fb0 | out: hHeap=0x310000) returned 1 [0267.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19600 | out: hHeap=0x310000) returned 1 [0267.474] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0267.474] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0267.475] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.475] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0267.485] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.485] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0267.486] CloseHandle (hObject=0x5c0) returned 1 [0267.486] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0267.486] RmStartSession () returned 0x0 [0267.487] RmRegisterResources () returned 0x0 [0267.491] RmGetList () returned 0x0 [0267.759] RmShutdown () returned 0x0 [0270.675] RmEndSession () returned 0x0 [0270.676] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x52618c8) returned 1 [0270.676] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0270.676] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF", dwFileAttributes=0x220) returned 1 [0270.677] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0270.677] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0270.677] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=8097) returned 1 [0270.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0270.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e0020 [0272.858] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0272.858] GetLastError () returned 0x0 [0272.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0272.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x366f740, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xAw10", lpUsedDefaultChar=0x0) returned 5 [0272.859] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0272.859] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0272.859] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0272.860] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x366f87c*=0xe58, lpOverlapped=0x0) returned 1 [0272.860] CloseHandle (hObject=0x5c0) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b41b8 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cb7a0 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0272.861] CryptDestroyKey (hKey=0x52618c8) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570898 | out: hHeap=0x310000) returned 1 [0272.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5ee0 | out: hHeap=0x310000) returned 1 [0272.861] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0272.861] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0272.861] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.861] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0272.876] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.876] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0272.876] CloseHandle (hObject=0x5c0) returned 1 [0272.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0272.876] RmStartSession () returned 0x0 [0273.037] RmRegisterResources () returned 0x0 [0273.037] RmGetList () returned 0x0 [0273.192] RmShutdown () returned 0x0 [0274.537] RmEndSession () returned 0x0 [0274.538] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260f08) returned 1 [0274.538] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0274.538] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF", dwFileAttributes=0x220) returned 1 [0274.539] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0274.539] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0274.539] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=3378) returned 1 [0274.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0274.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621d020 [0275.104] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0275.104] GetLastError () returned 0x0 [0275.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0275.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x366f740, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0275.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0275.105] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0275.105] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0275.105] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0275.105] WriteFile (in: hFile=0x564, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x366f87c*=0xe5e, lpOverlapped=0x0) returned 1 [0275.106] CloseHandle (hObject=0x564) returned 1 [0275.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0275.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0275.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0275.106] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cedc10 | out: hHeap=0x310000) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0275.107] CryptDestroyKey (hKey=0x5260f08) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b50 | out: hHeap=0x310000) returned 1 [0275.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e32c0 | out: hHeap=0x310000) returned 1 [0275.107] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0275.107] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0275.107] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.107] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0275.155] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.155] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0275.155] CloseHandle (hObject=0x564) returned 1 [0275.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0275.155] RmStartSession () returned 0x0 [0275.158] RmRegisterResources () returned 0x0 [0275.164] RmGetList () returned 0x0 [0276.242] RmShutdown () returned 0x0 [0277.766] RmEndSession () returned 0x0 [0277.767] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261048) returned 1 [0277.767] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0277.767] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF", dwFileAttributes=0x220) returned 1 [0277.768] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0277.768] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0277.768] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=7968) returned 1 [0277.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0277.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79ee020 [0278.210] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0278.210] ReadFile (in: hFile=0x564, lpBuffer=0x79ee040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x79ee040*, lpNumberOfBytesRead=0x366f908*=0x1f20, lpOverlapped=0x0) returned 1 [0278.211] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0278.211] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5281b60*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5281b60*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0278.212] WriteFile (in: hFile=0x564, lpBuffer=0x5281b60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5281b60*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0278.212] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0278.212] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0278.212] WriteFile (in: hFile=0x564, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0278.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79ee020 | out: hHeap=0x310000) returned 1 [0278.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5281b40 | out: hHeap=0x310000) returned 1 [0278.713] CloseHandle (hObject=0x564) returned 1 [0278.713] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0278.713] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0278.713] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4988 [0278.713] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0278.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0278.713] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0278.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5140 [0278.714] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0278.714] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0278.714] GetLastError () returned 0x0 [0278.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0278.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0278.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x38c188, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5PaBVzxQBGd15AjyqsacvL0n", lpUsedDefaultChar=0x0) returned 24 [0278.715] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7af50 | out: hHeap=0x310000) returned 1 [0278.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0278.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0278.715] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0278.715] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0278.716] WriteFile (in: hFile=0x564, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x366f87c*=0xe6b, lpOverlapped=0x0) returned 1 [0278.717] CloseHandle (hObject=0x564) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5140 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4988 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0278.717] CryptDestroyKey (hKey=0x5261048) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0278.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6018 | out: hHeap=0x310000) returned 1 [0278.718] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e36d0 | out: hHeap=0x310000) returned 1 [0278.718] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0278.718] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0278.718] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.718] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0278.761] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.761] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0278.761] CloseHandle (hObject=0x564) returned 1 [0278.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0278.761] RmStartSession () returned 0x0 [0278.764] RmRegisterResources () returned 0x0 [0278.769] RmGetList () returned 0x0 [0280.956] RmShutdown () returned 0x0 [0284.118] RmEndSession () returned 0x0 [0284.118] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5260f08) returned 1 [0284.119] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0284.119] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF", dwFileAttributes=0x220) returned 1 [0284.119] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0284.119] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0284.119] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=4612) returned 1 [0284.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c6d010 [0284.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7c42020 [0284.998] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0284.998] ReadFile (in: hFile=0x564, lpBuffer=0x7c42040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x7c42040*, lpNumberOfBytesRead=0x366f908*=0x1204, lpOverlapped=0x0) returned 1 [0285.000] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0285.000] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0285.000] WriteFile (in: hFile=0x564, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0285.000] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0285.000] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0285.000] WriteFile (in: hFile=0x564, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0285.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7c42020 | out: hHeap=0x310000) returned 1 [0285.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c6d010 | out: hHeap=0x310000) returned 1 [0285.005] CloseHandle (hObject=0x564) returned 1 [0285.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0285.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0285.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0285.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0285.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0285.006] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0285.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0285.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0285.007] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0285.007] GetLastError () returned 0x0 [0285.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x366f740, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0285.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0285.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0285.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0285.007] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0285.008] WriteFile (in: hFile=0x564, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x366f87c*=0xe5f, lpOverlapped=0x0) returned 1 [0285.009] CloseHandle (hObject=0x564) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0285.009] CryptDestroyKey (hKey=0x5260f08) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94508 | out: hHeap=0x310000) returned 1 [0285.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1ab0 | out: hHeap=0x310000) returned 1 [0285.009] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0285.009] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0285.010] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.010] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0285.011] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.011] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0285.011] CloseHandle (hObject=0x564) returned 1 [0285.011] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0285.011] RmStartSession () returned 0x0 [0285.013] RmRegisterResources () returned 0x0 [0285.017] RmGetList () returned 0x0 [0286.359] RmShutdown () returned 0x0 [0288.683] RmEndSession () returned 0x0 [0288.685] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261148) returned 1 [0288.685] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0288.685] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF", dwFileAttributes=0x220) returned 1 [0288.685] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0288.685] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0288.685] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=24778) returned 1 [0288.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0288.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e3020 [0289.193] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0289.193] ReadFile (in: hFile=0x564, lpBuffer=0x49e3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x49e3040*, lpNumberOfBytesRead=0x366f908*=0x60ca, lpOverlapped=0x0) returned 1 [0289.195] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0289.195] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0289.195] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0289.196] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0289.196] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0289.196] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0289.196] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0289.196] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0289.196] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0289.196] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0289.196] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0289.196] WriteFile (in: hFile=0x564, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0289.197] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e3020 | out: hHeap=0x310000) returned 1 [0289.431] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0289.431] CloseHandle (hObject=0x564) returned 1 [0289.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0289.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0289.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0289.432] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4938 [0289.432] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0289.432] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0289.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.433] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0289.433] GetLastError () returned 0x0 [0289.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0289.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0289.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x38c3b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ac9GKTK0aPkhGvcK4dkln2M2j", lpUsedDefaultChar=0x0) returned 25 [0289.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e0a0 | out: hHeap=0x310000) returned 1 [0289.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0289.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0289.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.434] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0289.435] WriteFile (in: hFile=0x564, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x366f87c*=0xe6c, lpOverlapped=0x0) returned 1 [0289.436] CloseHandle (hObject=0x564) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4938 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0289.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0289.437] CryptDestroyKey (hKey=0x5261148) returned 1 [0289.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0289.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95180 | out: hHeap=0x310000) returned 1 [0289.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2820 | out: hHeap=0x310000) returned 1 [0289.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0289.437] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0289.437] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.437] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0289.439] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.439] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0289.440] CloseHandle (hObject=0x564) returned 1 [0289.440] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4b50 [0289.440] RmStartSession () returned 0x0 [0290.275] RmRegisterResources () returned 0x0 [0290.275] RmGetList () returned 0x0 [0290.470] RmShutdown () returned 0x0 [0292.509] RmEndSession () returned 0x0 [0292.854] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x35db08) returned 1 [0292.854] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0292.854] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF", dwFileAttributes=0x220) returned 1 [0292.855] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0292.855] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0292.855] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=7862) returned 1 [0292.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0292.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d31020 [0292.875] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0292.875] ReadFile (in: hFile=0x500, lpBuffer=0x4d31040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x4d31040*, lpNumberOfBytesRead=0x366f908*=0x1eb6, lpOverlapped=0x0) returned 1 [0292.989] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0292.989] CryptEncrypt (in: hKey=0x35db08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0292.989] WriteFile (in: hFile=0x500, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0292.989] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0292.989] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0292.990] WriteFile (in: hFile=0x500, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0292.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d31020 | out: hHeap=0x310000) returned 1 [0293.074] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0293.074] CloseHandle (hObject=0x500) returned 1 [0293.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0293.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5f80 [0293.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5db8 [0293.075] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5290 [0293.075] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5f80 | out: hHeap=0x310000) returned 1 [0293.075] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0293.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4be8 [0293.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0293.076] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0293.076] GetLastError () returned 0x0 [0293.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0293.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x366f740, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0293.077] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0293.077] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x515d4e0 [0293.077] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0293.077] WriteFile (in: hFile=0x500, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x366f87c*=0xe59, lpOverlapped=0x0) returned 1 [0293.078] CloseHandle (hObject=0x500) returned 1 [0293.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x515d4e0 | out: hHeap=0x310000) returned 1 [0293.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4be8 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5290 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5db8 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0293.079] CryptDestroyKey (hKey=0x35db08) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b50 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95d60 | out: hHeap=0x310000) returned 1 [0293.079] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19790 | out: hHeap=0x310000) returned 1 [0293.079] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0293.079] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0293.079] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.079] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0293.081] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.081] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0293.081] CloseHandle (hObject=0x500) returned 1 [0293.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5db8 [0293.081] RmStartSession () returned 0x0 [0293.681] RmRegisterResources () returned 0x0 [0293.682] RmGetList () returned 0x0 [0295.518] RmShutdown () returned 0x0 [0295.561] RmEndSession () returned 0x0 [0295.562] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261388) returned 1 [0295.562] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0295.562] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF", dwFileAttributes=0x220) returned 1 [0295.562] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0295.562] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0295.563] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=13102) returned 1 [0295.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0295.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57c4020 [0296.469] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0296.469] ReadFile (in: hFile=0x610, lpBuffer=0x57c4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x57c4040*, lpNumberOfBytesRead=0x366f908*=0x332e, lpOverlapped=0x0) returned 1 [0296.470] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0296.470] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0296.470] WriteFile (in: hFile=0x610, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0296.470] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0296.470] WriteFile (in: hFile=0x610, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0296.470] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0296.470] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0296.470] WriteFile (in: hFile=0x610, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0296.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57c4020 | out: hHeap=0x310000) returned 1 [0296.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0296.647] CloseHandle (hObject=0x610) returned 1 [0296.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0296.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606f4e0 [0296.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c953e0 [0296.648] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606f9e8 [0296.648] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606f4e0 | out: hHeap=0x310000) returned 1 [0296.649] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94d58 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0296.650] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0296.650] GetLastError () returned 0x0 [0296.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0296.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x38c070, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e0sG9NpfUiifqv54", lpUsedDefaultChar=0x0) returned 16 [0296.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0296.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0296.650] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0296.651] WriteFile (in: hFile=0x610, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x366f87c*=0xe63, lpOverlapped=0x0) returned 1 [0296.652] CloseHandle (hObject=0x610) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94d58 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606f9e8 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c953e0 | out: hHeap=0x310000) returned 1 [0296.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0296.653] CryptDestroyKey (hKey=0x5261388) returned 1 [0296.653] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5db8 | out: hHeap=0x310000) returned 1 [0296.653] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306580 | out: hHeap=0x310000) returned 1 [0296.653] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a128 | out: hHeap=0x310000) returned 1 [0296.653] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0296.653] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0296.653] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.653] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0296.665] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.665] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0296.665] CloseHandle (hObject=0x610) returned 1 [0296.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c953e0 [0296.665] RmStartSession () returned 0x0 [0296.669] RmRegisterResources () returned 0x0 [0296.673] RmGetList () returned 0x0 [0297.237] RmShutdown () returned 0x0 [0298.310] RmEndSession () returned 0x0 [0298.311] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x366fa08 | out: phKey=0x366fa08*=0x5261048) returned 1 [0298.311] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0298.312] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF", dwFileAttributes=0x220) returned 1 [0298.312] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0298.312] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x366f868*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x366f868*=0x2000) returned 1 [0298.312] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x366f900 | out: lpFileSize=0x366f900*=29004) returned 1 [0298.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0298.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x780b020 [0298.561] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0298.561] ReadFile (in: hFile=0x610, lpBuffer=0x780b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x366f908, lpOverlapped=0x0 | out: lpBuffer=0x780b040*, lpNumberOfBytesRead=0x366f908*=0x714c, lpOverlapped=0x0) returned 1 [0298.562] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f0 | out: lpNewFilePointer=0x0) returned 1 [0298.562] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0298.562] WriteFile (in: hFile=0x610, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0298.562] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0298.562] WriteFile (in: hFile=0x610, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0298.563] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0298.563] WriteFile (in: hFile=0x610, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0298.563] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x366f87c*=0x2000) returned 1 [0298.563] WriteFile (in: hFile=0x610, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x366f90c*=0x2000, lpOverlapped=0x0) returned 1 [0298.563] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366f8f8 | out: lpNewFilePointer=0x0) returned 1 [0298.563] WriteFile (in: hFile=0x610, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x366f90c*=0x200, lpOverlapped=0x0) returned 1 [0298.563] WriteFile (in: hFile=0x610, lpBuffer=0x366f8a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x366f8a8*, lpNumberOfBytesWritten=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0298.563] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x780b020 | out: hHeap=0x310000) returned 1 [0298.608] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0298.608] CloseHandle (hObject=0x610) returned 1 [0298.608] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0298.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606d260 [0298.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95050 [0298.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606cbe8 [0298.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606d260 | out: hHeap=0x310000) returned 1 [0298.609] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0298.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94508 [0298.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0298.610] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x366f6dc | out: lpSystemTimeAsFileTime=0x366f6dc) [0298.610] GetLastError () returned 0x0 [0298.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rkb0olPmAw8J5Hrd7OWIRX", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0298.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0298.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rkb0olPmAw8J5Hrd7OWIRX", cchWideChar=22, lpMultiByteStr=0x38c480, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rkb0olPmAw8J5Hrd7OWIRX", lpUsedDefaultChar=0x0) returned 22 [0298.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0298.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0298.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0298.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0298.611] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0298.612] WriteFile (in: hFile=0x610, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x366f87c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x366f87c*=0xe69, lpOverlapped=0x0) returned 1 [0298.613] CloseHandle (hObject=0x610) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94508 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606cbe8 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95050 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0298.613] CryptDestroyKey (hKey=0x5261048) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c953e0 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5305f90 | out: hHeap=0x310000) returned 1 [0298.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a858 | out: hHeap=0x310000) returned 1 [0298.613] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x366fa3c, lpCompletionKey=0x366fa40, lpOverlapped=0x366fa38) returned 1 [0298.613] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0298.614] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f910 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.614] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f90c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f90c*=0x18, lpOverlapped=0x0) returned 1 [0298.627] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366f918 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.627] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x366f900, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x366f900*=0x18, lpOverlapped=0x0) returned 1 [0298.627] CloseHandle (hObject=0x610) returned 1 [0298.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c953e0 [0298.627] RmStartSession () returned 0x0 [0298.630] RmRegisterResources () returned 0x0 [0298.634] RmGetList () returned 0x0 [0299.551] RmShutdown () Thread: id = 12 os_tid = 0x10d8 [0068.590] GetLastError () returned 0x57 [0068.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x34ca08 [0068.591] SetLastError (dwErrCode=0x57) [0068.591] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0069.608] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0070.883] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0079.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0082.379] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0088.604] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0091.084] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0095.858] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0096.957] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0101.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0104.165] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0105.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0109.744] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0110.847] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0119.222] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0120.250] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0121.433] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0123.482] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0126.620] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0135.625] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0135.625] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.625] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0135.654] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.654] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0135.654] CloseHandle (hObject=0x5c0) returned 1 [0135.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0135.654] RmStartSession () returned 0x0 [0137.796] RmRegisterResources () returned 0x0 [0137.807] RmGetList () returned 0x0 [0140.002] RmShutdown () returned 0x0 [0141.939] RmEndSession () returned 0x0 [0141.940] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261608) returned 1 [0141.941] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0141.941] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.941] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0141.941] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0141.941] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=3314) returned 1 [0141.941] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ade80 [0141.941] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x66ae020 [0142.131] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0142.131] ReadFile (in: hFile=0x5b0, lpBuffer=0x66ae040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x66ae040*, lpNumberOfBytesRead=0x37afa2c*=0xcf2, lpOverlapped=0x0) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0142.133] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54adea0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x54adea0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0142.133] WriteFile (in: hFile=0x5b0, lpBuffer=0x54adea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x54adea0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x5b0, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0142.133] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x66ae020 | out: hHeap=0x310000) returned 1 [0143.256] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ade80 | out: hHeap=0x310000) returned 1 [0143.256] CloseHandle (hObject=0x5b0) returned 1 [0143.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0143.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a20a0 [0143.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0143.257] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0143.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a20a0 | out: hHeap=0x310000) returned 1 [0143.257] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1030\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0143.261] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0143.261] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0143.262] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.262] GetLastError () returned 0x0 [0143.262] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb58 [0143.263] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] GetLastError () returned 0x0 [0143.263] SetLastError (dwErrCode=0x0) [0143.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x51e60b0 [0143.263] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0143.263] GetLastError () returned 0x0 [0143.264] SetLastError (dwErrCode=0x0) [0143.264] GetLastError () returned 0x0 [0143.264] SetLastError (dwErrCode=0x0) [0143.264] GetLastError () returned 0x0 [0143.264] SetLastError (dwErrCode=0x0) [0143.264] GetLastError () returned 0x0 [0143.264] SetLastError (dwErrCode=0x0) [0143.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0143.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0143.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", cchWideChar=28, lpMultiByteStr=0x38c188, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Af9qnOt4MB1nW4xDyi9PI77wNl0y", lpUsedDefaultChar=0x0) returned 28 [0143.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e60b0 | out: hHeap=0x310000) returned 1 [0143.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0143.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0143.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0143.264] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0143.264] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x37af9a0*=0xe6f, lpOverlapped=0x0) returned 1 [0143.265] CloseHandle (hObject=0x5b0) returned 1 [0143.265] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0143.265] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0143.266] CryptDestroyKey (hKey=0x5261608) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399458 | out: hHeap=0x310000) returned 1 [0143.266] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3659f8 | out: hHeap=0x310000) returned 1 [0143.266] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0143.266] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0143.266] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.266] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0143.370] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.371] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0143.371] CloseHandle (hObject=0x5b0) returned 1 [0143.371] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5158 [0143.371] RmStartSession () returned 0x0 [0143.374] RmRegisterResources () returned 0x0 [0143.379] RmGetList () returned 0x0 [0143.733] RmShutdown () returned 0x0 [0145.113] RmEndSession () returned 0x0 [0145.114] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260f08) returned 1 [0145.114] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0145.114] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x80) returned 1 [0145.115] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0145.115] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0145.115] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=12687) returned 1 [0145.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c94018 [0145.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b5020 [0145.605] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0145.605] ReadFile (in: hFile=0x5b0, lpBuffer=0x64b5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x64b5040*, lpNumberOfBytesRead=0x37afa2c*=0x318f, lpOverlapped=0x0) returned 1 [0145.607] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0145.607] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c94020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c94020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0145.607] WriteFile (in: hFile=0x5b0, lpBuffer=0x5c94020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5c94020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0145.607] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c94020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c94020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0145.607] WriteFile (in: hFile=0x5b0, lpBuffer=0x5c94020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5c94020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0145.607] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0145.607] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0145.607] WriteFile (in: hFile=0x5b0, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0145.607] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b5020 | out: hHeap=0x310000) returned 1 [0146.109] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94018 | out: hHeap=0x310000) returned 1 [0146.109] CloseHandle (hObject=0x5b0) returned 1 [0146.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0146.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0146.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0146.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c28 [0146.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0146.110] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1042\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0146.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3992f8 [0146.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397de0 [0146.111] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0146.111] GetLastError () returned 0x0 [0146.111] SetLastError (dwErrCode=0x0) [0146.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0146.111] GetLastError () returned 0x0 [0146.111] SetLastError (dwErrCode=0x0) [0146.111] GetLastError () returned 0x0 [0146.111] SetLastError (dwErrCode=0x0) [0146.111] GetLastError () returned 0x0 [0146.111] SetLastError (dwErrCode=0x0) [0146.111] GetLastError () returned 0x0 [0146.111] SetLastError (dwErrCode=0x0) [0146.111] GetLastError () returned 0x0 [0146.112] SetLastError (dwErrCode=0x0) [0146.112] GetLastError () returned 0x0 [0146.112] SetLastError (dwErrCode=0x0) [0146.112] GetLastError () returned 0x0 [0146.112] SetLastError (dwErrCode=0x0) [0146.112] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0146.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0146.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x37af860, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0146.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0146.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a230 [0146.112] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1042\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0146.113] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x37af9a0*=0xe59, lpOverlapped=0x0) returned 1 [0146.114] CloseHandle (hObject=0x5b0) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397de0 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3992f8 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c28 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0146.115] CryptDestroyKey (hKey=0x5260f08) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5158 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0146.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19060 | out: hHeap=0x310000) returned 1 [0146.115] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0146.115] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0146.116] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.116] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0146.117] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.117] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0146.117] CloseHandle (hObject=0x5b0) returned 1 [0146.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0146.118] RmStartSession () returned 0x0 [0146.567] RmRegisterResources () returned 0x0 [0146.571] RmGetList () returned 0x0 [0146.718] RmShutdown () returned 0x0 [0147.377] RmEndSession () returned 0x0 [0147.381] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261448) returned 1 [0147.381] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0147.381] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x80) returned 1 [0147.381] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0147.381] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0147.382] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=3865) returned 1 [0147.382] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5609038 [0147.382] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a24020 [0147.542] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0147.542] ReadFile (in: hFile=0x578, lpBuffer=0x6a24040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x6a24040*, lpNumberOfBytesRead=0x37afa2c*=0xf19, lpOverlapped=0x0) returned 1 [0147.543] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0147.543] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5609040*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5609040*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0147.543] WriteFile (in: hFile=0x578, lpBuffer=0x5609040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5609040*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0147.544] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0147.544] WriteFile (in: hFile=0x578, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0x578, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0147.544] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a24020 | out: hHeap=0x310000) returned 1 [0147.585] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609038 | out: hHeap=0x310000) returned 1 [0147.585] CloseHandle (hObject=0x578) returned 1 [0147.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0147.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0147.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399400 [0147.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0147.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0147.586] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1053\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0147.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c18 [0147.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397de0 [0147.587] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0147.587] GetLastError () returned 0x0 [0147.587] SetLastError (dwErrCode=0x0) [0147.587] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb8a8 [0147.587] GetLastError () returned 0x0 [0147.587] SetLastError (dwErrCode=0x0) [0147.587] GetLastError () returned 0x0 [0147.587] SetLastError (dwErrCode=0x0) [0147.587] GetLastError () returned 0x0 [0147.587] SetLastError (dwErrCode=0x0) [0147.587] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0147.588] GetLastError () returned 0x0 [0147.588] SetLastError (dwErrCode=0x0) [0147.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0147.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0147.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aA4HcB1IE", cchWideChar=9, lpMultiByteStr=0x37af860, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aA4HcB1IE", lpUsedDefaultChar=0x0) returned 9 [0147.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0147.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0147.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0147.588] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1053\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0147.589] WriteFile (in: hFile=0x578, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x37af9a0*=0xe5c, lpOverlapped=0x0) returned 1 [0147.590] CloseHandle (hObject=0x578) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397de0 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c18 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399400 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0147.590] CryptDestroyKey (hKey=0x5261448) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399ae0 | out: hHeap=0x310000) returned 1 [0147.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ac0 | out: hHeap=0x310000) returned 1 [0147.590] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0147.591] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0147.591] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.591] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0147.598] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.598] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0147.598] CloseHandle (hObject=0x578) returned 1 [0147.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3995b8 [0147.598] RmStartSession () returned 0x0 [0147.601] RmRegisterResources () returned 0x0 [0147.605] RmGetList () returned 0x0 [0147.736] RmShutdown () returned 0x0 [0148.058] RmEndSession () returned 0x0 [0148.059] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260fc8) returned 1 [0148.059] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0148.059] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x80) returned 1 [0148.059] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0148.060] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0148.060] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=5827) returned 1 [0148.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0148.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a2e020 [0148.654] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0148.655] ReadFile (in: hFile=0x578, lpBuffer=0x6a2e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x6a2e040*, lpNumberOfBytesRead=0x37afa2c*=0x16c3, lpOverlapped=0x0) returned 1 [0148.663] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0148.663] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0148.663] WriteFile (in: hFile=0x578, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0148.663] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0148.663] WriteFile (in: hFile=0x578, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0148.664] WriteFile (in: hFile=0x578, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0148.664] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a2e020 | out: hHeap=0x310000) returned 1 [0151.456] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0151.456] CloseHandle (hObject=0x578) returned 1 [0151.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0151.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1d60 [0151.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399ae0 [0151.457] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0151.457] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1d60 | out: hHeap=0x310000) returned 1 [0151.457] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\2052\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0151.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0151.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b10 [0151.459] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0151.459] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3120 [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.460] SetLastError (dwErrCode=0x0) [0151.460] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3a8 [0151.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] GetLastError () returned 0x0 [0151.461] SetLastError (dwErrCode=0x0) [0151.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3120 | out: hHeap=0x310000) returned 1 [0151.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0151.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0151.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c520, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0151.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3a8 | out: hHeap=0x310000) returned 1 [0151.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0151.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0151.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39d00 [0151.462] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2052\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0151.462] WriteFile (in: hFile=0x578, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x37af9a0*=0xe69, lpOverlapped=0x0) returned 1 [0151.463] CloseHandle (hObject=0x578) returned 1 [0151.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39d00 | out: hHeap=0x310000) returned 1 [0151.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0151.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0151.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0151.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399ae0 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0151.464] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3995b8 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5050 | out: hHeap=0x310000) returned 1 [0151.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19470 | out: hHeap=0x310000) returned 1 [0151.464] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0151.464] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0151.464] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.464] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0151.468] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.468] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0151.468] CloseHandle (hObject=0x578) returned 1 [0151.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0151.468] RmStartSession () returned 0x0 [0151.471] RmRegisterResources () returned 0x0 [0151.471] RmGetList () returned 0x0 [0154.547] RmShutdown () returned 0x0 [0157.399] RmEndSession () returned 0x0 [0157.686] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260cc8) returned 1 [0157.686] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0157.686] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico", dwFileAttributes=0x80) returned 1 [0157.686] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0157.686] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0157.686] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=894) returned 1 [0157.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8568 [0157.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64be020 [0157.705] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0157.705] ReadFile (in: hFile=0x578, lpBuffer=0x64be040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x64be040*, lpNumberOfBytesRead=0x37afa2c*=0x37e, lpOverlapped=0x0) returned 1 [0157.798] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0157.799] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0157.799] WriteFile (in: hFile=0x578, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0157.801] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0157.801] WriteFile (in: hFile=0x578, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0157.801] WriteFile (in: hFile=0x578, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0157.801] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64be020 | out: hHeap=0x310000) returned 1 [0157.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8568 | out: hHeap=0x310000) returned 1 [0157.806] CloseHandle (hObject=0x578) returned 1 [0157.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0157.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0157.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0157.807] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0157.807] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0157.808] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0157.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0157.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0157.809] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.809] GetLastError () returned 0x0 [0157.809] SetLastError (dwErrCode=0x0) [0157.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0157.810] GetLastError () returned 0x0 [0157.810] SetLastError (dwErrCode=0x0) [0157.810] GetLastError () returned 0x0 [0157.810] SetLastError (dwErrCode=0x0) [0157.810] GetLastError () returned 0x0 [0157.810] SetLastError (dwErrCode=0x0) [0157.810] GetLastError () returned 0x0 [0157.810] SetLastError (dwErrCode=0x0) [0157.810] GetLastError () returned 0x0 [0157.810] SetLastError (dwErrCode=0x0) [0157.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0157.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0WFjmsBgTPgpX", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0157.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0WFjmsBgTPgpX", cchWideChar=13, lpMultiByteStr=0x37af860, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0WFjmsBgTPgpX", lpUsedDefaultChar=0x0) returned 13 [0157.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0157.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0157.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0157.810] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3effa0 [0157.810] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0157.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0157.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0157.811] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50602f0 | out: hHeap=0x310000) returned 1 [0157.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5e90 | out: hHeap=0x310000) returned 1 [0157.811] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0157.811] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0157.812] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.548] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0158.549] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.550] ReadFile (in: hFile=0x578, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0158.550] CloseHandle (hObject=0x578) returned 1 [0158.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a30 [0158.550] RmStartSession () returned 0x0 [0159.249] RmRegisterResources () returned 0x0 [0159.264] RmGetList () returned 0x0 [0161.347] RmShutdown () returned 0x0 [0166.720] RmEndSession () returned 0x0 [0166.721] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260e48) returned 1 [0166.721] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0166.721] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x80) returned 1 [0166.721] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0166.721] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0166.721] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=30120) returned 1 [0166.721] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc2630 [0166.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf3020 [0167.549] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0167.549] ReadFile (in: hFile=0x66c, lpBuffer=0x4cf3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x4cf3040*, lpNumberOfBytesRead=0x37afa2c*=0x75a8, lpOverlapped=0x0) returned 1 [0167.551] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0167.551] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0167.551] WriteFile (in: hFile=0x66c, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0167.552] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0167.552] WriteFile (in: hFile=0x66c, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0167.552] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0167.552] WriteFile (in: hFile=0x66c, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0167.552] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0167.552] WriteFile (in: hFile=0x66c, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0167.552] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0167.552] WriteFile (in: hFile=0x66c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0167.552] WriteFile (in: hFile=0x66c, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0167.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf3020 | out: hHeap=0x310000) returned 1 [0169.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc2630 | out: hHeap=0x310000) returned 1 [0169.280] CloseHandle (hObject=0x66c) returned 1 [0169.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0169.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a28c0 [0169.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0169.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0169.282] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a28c0 | out: hHeap=0x310000) returned 1 [0169.282] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.bdcddcbaad"), dwFlags=0x1) returned 1 [0169.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0169.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0169.283] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3cd0 [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.283] GetLastError () returned 0x0 [0169.283] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6f8 [0169.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0169.284] GetLastError () returned 0x0 [0169.284] SetLastError (dwErrCode=0x0) [0169.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3cd0 | out: hHeap=0x310000) returned 1 [0169.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0169.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x38c160, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vsPfwZLZiAU4bA46v", lpUsedDefaultChar=0x0) returned 17 [0169.285] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6f8 | out: hHeap=0x310000) returned 1 [0169.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0169.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0169.285] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0169.285] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0169.286] WriteFile (in: hFile=0x66c, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x37af9a0*=0xe64, lpOverlapped=0x0) returned 1 [0169.286] CloseHandle (hObject=0x66c) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0169.287] CryptDestroyKey (hKey=0x5260e48) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a30 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0169.287] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5a30 | out: hHeap=0x310000) returned 1 [0169.287] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0169.287] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0169.287] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.287] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0169.289] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.289] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0169.289] CloseHandle (hObject=0x66c) returned 1 [0169.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53213f8 [0169.289] RmStartSession () returned 0x0 [0169.292] RmRegisterResources () returned 0x0 [0170.247] RmGetList () returned 0x0 [0175.151] RmShutdown () returned 0x0 [0181.436] RmEndSession () returned 0x0 [0181.931] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261548) returned 1 [0181.931] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0181.931] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0181.932] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0181.932] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0181.932] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=2166784) returned 1 [0181.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2088 [0181.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5720020 [0181.950] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0181.951] ReadFile (in: hFile=0x66c, lpBuffer=0x5720040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x5720040*, lpNumberOfBytesRead=0x37afa2c*=0x100000, lpOverlapped=0x0) returned 1 [0182.007] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.007] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.007] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.008] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.008] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.009] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.009] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.010] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.010] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.011] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.011] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.012] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.012] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.013] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.013] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.014] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.014] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.015] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.015] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.016] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.016] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.017] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.017] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.018] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.018] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.018] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.018] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.018] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.018] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.512] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.512] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.513] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.513] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.513] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.513] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.513] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.513] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.513] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.513] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.513] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.513] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.514] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.514] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.514] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.514] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.514] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.514] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.514] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.514] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.514] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.514] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.515] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.515] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.515] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.515] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.515] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.515] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.516] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.516] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.516] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.516] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.516] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.516] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.516] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.516] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.516] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.516] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.517] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.517] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.517] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.517] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.517] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.517] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.518] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.518] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.518] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.518] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.518] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.518] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.518] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.518] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.518] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.518] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.519] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.519] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.519] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.519] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.519] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.519] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.519] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.519] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.519] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.519] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.520] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.520] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.520] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.520] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.520] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.520] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.521] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.521] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.521] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.521] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.521] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0182.521] WriteFile (in: hFile=0x66c, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0182.522] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0182.522] WriteFile (in: hFile=0x66c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0182.544] WriteFile (in: hFile=0x66c, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0182.544] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5720020 | out: hHeap=0x310000) returned 1 [0183.242] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2088 | out: hHeap=0x310000) returned 1 [0183.242] CloseHandle (hObject=0x66c) returned 1 [0183.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0183.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9f50 [0183.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327c78 [0183.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51ca1f0 [0183.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9f50 | out: hHeap=0x310000) returned 1 [0183.545] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0183.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53278e8 [0183.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0183.545] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0183.545] GetLastError () returned 0x0 [0183.545] SetLastError (dwErrCode=0x0) [0183.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0183.545] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.546] GetLastError () returned 0x0 [0183.546] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7d8 [0183.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab278 [0183.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.547] SetLastError (dwErrCode=0x0) [0183.547] GetLastError () returned 0x0 [0183.548] SetLastError (dwErrCode=0x0) [0183.548] GetLastError () returned 0x0 [0183.548] SetLastError (dwErrCode=0x0) [0183.548] GetLastError () returned 0x0 [0183.548] SetLastError (dwErrCode=0x0) [0183.548] GetLastError () returned 0x0 [0183.548] SetLastError (dwErrCode=0x0) [0183.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0183.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0183.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0183.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x38c3e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", lpUsedDefaultChar=0x0) returned 31 [0183.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab278 | out: hHeap=0x310000) returned 1 [0183.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0183.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5410238 [0183.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0183.548] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0183.549] WriteFile (in: hFile=0x66c, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x37af9a0*=0xe72, lpOverlapped=0x0) returned 1 [0183.550] CloseHandle (hObject=0x66c) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53278e8 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ca1f0 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327c78 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0183.550] CryptDestroyKey (hKey=0x5261548) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53213f8 | out: hHeap=0x310000) returned 1 [0183.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cc00 | out: hHeap=0x310000) returned 1 [0183.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6380 | out: hHeap=0x310000) returned 1 [0183.551] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0183.551] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0183.551] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.551] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0183.552] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.552] ReadFile (in: hFile=0x66c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0183.552] CloseHandle (hObject=0x66c) returned 1 [0183.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0183.553] RmStartSession () returned 0x0 [0183.962] RmRegisterResources () returned 0x0 [0183.968] RmGetList () returned 0x0 [0185.331] RmShutdown () returned 0x0 [0189.142] RmEndSession () returned 0x0 [0189.143] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52611c8) returned 1 [0189.143] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0189.143] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x20) returned 1 [0189.144] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0189.144] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0189.144] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=69632) returned 1 [0189.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5415ce0 [0189.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6cc3020 [0189.162] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0189.162] ReadFile (in: hFile=0x640, lpBuffer=0x6cc3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x6cc3040*, lpNumberOfBytesRead=0x37afa2c*=0x11000, lpOverlapped=0x0) returned 1 [0189.180] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0189.180] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.180] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.181] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.181] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.182] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.182] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.182] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5415d00*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0189.182] WriteFile (in: hFile=0x640, lpBuffer=0x5415d00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5415d00*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0189.182] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0189.182] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0189.182] WriteFile (in: hFile=0x640, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0189.182] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6cc3020 | out: hHeap=0x310000) returned 1 [0189.187] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5415ce0 | out: hHeap=0x310000) returned 1 [0189.187] CloseHandle (hObject=0x640) returned 1 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0189.190] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0189.190] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0189.190] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.190] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0189.190] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.191] SetLastError (dwErrCode=0x0) [0189.191] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb58 [0189.192] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] GetLastError () returned 0x0 [0189.192] SetLastError (dwErrCode=0x0) [0189.192] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0189.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0189.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0189.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x38c098, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3p1r5Y6j1RhQxDJosxt", lpUsedDefaultChar=0x0) returned 19 [0189.192] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0189.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0189.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5409c80 [0189.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0189.192] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0189.193] WriteFile (in: hFile=0x640, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x37af9a0*=0xe66, lpOverlapped=0x0) returned 1 [0189.194] CloseHandle (hObject=0x640) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0189.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0189.194] CryptDestroyKey (hKey=0x52611c8) returned 1 [0189.195] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0189.195] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0189.195] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6a10 | out: hHeap=0x310000) returned 1 [0189.195] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0189.195] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0189.195] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.195] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0189.376] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.377] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0189.377] CloseHandle (hObject=0x640) returned 1 [0189.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0c48 [0189.377] RmStartSession () returned 0x0 [0189.579] RmRegisterResources () returned 0x0 [0189.583] RmGetList () returned 0x0 [0191.468] RmShutdown () returned 0x0 [0193.066] RmEndSession () returned 0x0 [0193.067] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x35d808) returned 1 [0193.067] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0193.067] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x20) returned 1 [0193.067] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0193.067] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0193.067] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=69632) returned 1 [0193.067] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61ba008 [0193.068] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57cd020 [0193.771] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0193.771] ReadFile (in: hFile=0x640, lpBuffer=0x57cd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x57cd040*, lpNumberOfBytesRead=0x37afa2c*=0x11000, lpOverlapped=0x0) returned 1 [0193.796] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0193.796] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.797] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.797] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.798] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.798] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0193.798] WriteFile (in: hFile=0x640, lpBuffer=0x61ba020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x61ba020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0193.798] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x640, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0193.798] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57cd020 | out: hHeap=0x310000) returned 1 [0193.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61ba008 | out: hHeap=0x310000) returned 1 [0193.963] CloseHandle (hObject=0x640) returned 1 [0193.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0193.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0193.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0193.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0193.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0193.964] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f05b8 [0193.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0193.965] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0193.965] GetLastError () returned 0x0 [0193.965] SetLastError (dwErrCode=0x0) [0193.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0193.965] GetLastError () returned 0x0 [0193.965] SetLastError (dwErrCode=0x0) [0193.965] GetLastError () returned 0x0 [0193.965] SetLastError (dwErrCode=0x0) [0193.965] GetLastError () returned 0x0 [0193.965] SetLastError (dwErrCode=0x0) [0193.965] GetLastError () returned 0x0 [0193.965] SetLastError (dwErrCode=0x0) [0193.965] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0193.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x37af860, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwY", lpUsedDefaultChar=0x0) returned 3 [0193.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0193.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0193.965] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0193.966] WriteFile (in: hFile=0x640, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x37af9a0*=0xe56, lpOverlapped=0x0) returned 1 [0193.967] CloseHandle (hObject=0x640) returned 1 [0193.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0193.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0193.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0193.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f05b8 | out: hHeap=0x310000) returned 1 [0193.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0193.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0193.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0193.968] CryptDestroyKey (hKey=0x35d808) returned 1 [0193.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0c48 | out: hHeap=0x310000) returned 1 [0193.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0193.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44768 | out: hHeap=0x310000) returned 1 [0193.968] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0193.968] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0193.970] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.970] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0193.972] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.972] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0193.972] CloseHandle (hObject=0x5c0) returned 1 [0193.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5354ed8 [0193.972] RmStartSession () returned 0x0 [0194.255] RmRegisterResources () returned 0x0 [0194.259] RmGetList () returned 0x0 [0196.636] RmShutdown () returned 0x0 [0200.432] RmEndSession () returned 0x0 [0200.433] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52612c8) returned 1 [0200.433] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0200.433] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0200.434] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.434] CryptDestroyKey (hKey=0x52612c8) returned 1 [0200.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5354ed8 | out: hHeap=0x310000) returned 1 [0200.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92c10 | out: hHeap=0x310000) returned 1 [0200.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b448a8 | out: hHeap=0x310000) returned 1 [0200.434] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0200.434] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0200.434] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.434] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0200.459] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.459] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0200.459] CloseHandle (hObject=0x518) returned 1 [0200.459] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8c08 [0200.460] RmStartSession () returned 0x0 [0200.463] RmRegisterResources () returned 0x0 [0200.467] RmGetList () returned 0x0 [0200.904] RmShutdown () returned 0x0 [0204.728] RmEndSession () returned 0x0 [0204.867] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261208) returned 1 [0204.867] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0204.867] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", dwFileAttributes=0x20) returned 0 [0204.867] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.868] CryptDestroyKey (hKey=0x5261208) returned 1 [0204.868] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8c08 | out: hHeap=0x310000) returned 1 [0204.868] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cc98 | out: hHeap=0x310000) returned 1 [0204.868] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08280 | out: hHeap=0x310000) returned 1 [0204.868] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0204.868] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0204.956] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.956] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0204.958] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.958] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0204.958] CloseHandle (hObject=0x554) returned 1 [0204.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b68b0 [0204.958] RmStartSession () returned 0x0 [0205.112] RmRegisterResources () returned 0x0 [0205.112] RmGetList () returned 0x0 [0205.152] RmShutdown () returned 0x0 [0205.664] RmEndSession () returned 0x0 [0205.665] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261008) returned 1 [0205.665] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0205.665] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", dwFileAttributes=0x20) returned 0 [0205.665] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.665] CryptDestroyKey (hKey=0x5261008) returned 1 [0205.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b68b0 | out: hHeap=0x310000) returned 1 [0205.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c920e8 | out: hHeap=0x310000) returned 1 [0205.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08870 | out: hHeap=0x310000) returned 1 [0205.665] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0205.665] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0205.666] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.666] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0205.706] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.706] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0205.706] CloseHandle (hObject=0x678) returned 1 [0205.706] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ed200 [0205.707] RmStartSession () returned 0x0 [0205.710] RmRegisterResources () returned 0x0 [0205.714] RmGetList () returned 0x0 [0206.388] RmShutdown () returned 0x0 [0208.876] RmEndSession () returned 0x0 [0208.931] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52610c8) returned 1 [0208.931] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0208.931] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", dwFileAttributes=0x20) returned 0 [0208.931] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.931] CryptDestroyKey (hKey=0x52610c8) returned 1 [0208.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ed200 | out: hHeap=0x310000) returned 1 [0208.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0208.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08780 | out: hHeap=0x310000) returned 1 [0208.931] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0208.931] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0208.964] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.964] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0209.022] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.022] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0209.022] CloseHandle (hObject=0x694) returned 1 [0209.023] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f8cb8 [0209.023] RmStartSession () returned 0x0 [0209.027] RmRegisterResources () returned 0x0 [0209.031] RmGetList () returned 0x0 [0210.414] RmShutdown () returned 0x0 [0214.363] RmEndSession () returned 0x0 [0214.769] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261488) returned 1 [0214.769] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0214.770] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", dwFileAttributes=0x20) returned 0 [0214.770] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.770] CryptDestroyKey (hKey=0x5261488) returned 1 [0214.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f8cb8 | out: hHeap=0x310000) returned 1 [0214.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a13c0 | out: hHeap=0x310000) returned 1 [0214.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5510 | out: hHeap=0x310000) returned 1 [0214.770] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0214.770] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0214.770] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.770] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0214.811] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.811] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0214.812] CloseHandle (hObject=0x550) returned 1 [0214.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bcf60 [0214.812] RmStartSession () returned 0x0 [0214.815] RmRegisterResources () returned 0x0 [0214.819] RmGetList () returned 0x0 [0215.251] RmShutdown () returned 0x0 [0221.509] RmEndSession () returned 0x0 [0221.510] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261488) returned 1 [0221.511] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0221.511] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml", dwFileAttributes=0x20) returned 0 [0221.511] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.511] CryptDestroyKey (hKey=0x5261488) returned 1 [0221.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bcf60 | out: hHeap=0x310000) returned 1 [0221.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eba40 | out: hHeap=0x310000) returned 1 [0221.511] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5f60 | out: hHeap=0x310000) returned 1 [0221.511] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0221.511] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0221.512] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.512] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0221.586] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.586] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0221.586] CloseHandle (hObject=0x550) returned 1 [0221.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0221.586] RmStartSession () returned 0x0 [0222.271] RmRegisterResources () returned 0x0 [0222.272] RmGetList () returned 0x0 [0222.380] RmShutdown () returned 0x0 [0223.366] RmEndSession () returned 0x0 [0223.368] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261148) returned 1 [0223.368] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0223.368] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0223.368] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.368] CryptDestroyKey (hKey=0x5261148) returned 1 [0223.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0223.369] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee9d8 | out: hHeap=0x310000) returned 1 [0223.369] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14880 | out: hHeap=0x310000) returned 1 [0223.369] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0223.369] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0223.369] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.369] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0223.371] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.372] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0223.372] CloseHandle (hObject=0x550) returned 1 [0223.372] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0223.372] RmStartSession () returned 0x0 [0223.375] RmRegisterResources () returned 0x0 [0223.375] RmGetList () returned 0x0 [0223.619] RmShutdown () returned 0x0 [0226.544] RmEndSession () returned 0x0 [0226.544] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261088) returned 1 [0226.544] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0226.545] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0226.545] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.545] CryptDestroyKey (hKey=0x5261088) returned 1 [0226.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0226.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee1f8 | out: hHeap=0x310000) returned 1 [0226.545] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14740 | out: hHeap=0x310000) returned 1 [0226.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0226.545] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0226.545] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.545] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0226.546] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.546] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0226.546] CloseHandle (hObject=0x550) returned 1 [0226.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0226.546] RmStartSession () returned 0x0 [0226.549] RmRegisterResources () returned 0x0 [0226.549] RmGetList () returned 0x0 [0227.707] RmShutdown () returned 0x0 [0229.453] RmEndSession () returned 0x0 [0229.454] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260e08) returned 1 [0229.454] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0229.454] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm", dwFileAttributes=0x20) returned 0 [0229.454] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.454] CryptDestroyKey (hKey=0x5260e08) returned 1 [0229.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0229.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55712b0 | out: hHeap=0x310000) returned 1 [0229.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14ce0 | out: hHeap=0x310000) returned 1 [0229.455] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0229.455] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0229.488] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.488] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0229.529] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.529] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0229.529] CloseHandle (hObject=0x668) returned 1 [0229.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0900 [0229.529] RmStartSession () returned 0x0 [0229.771] RmRegisterResources () returned 0x0 [0229.772] RmGetList () returned 0x0 [0229.820] RmShutdown () returned 0x0 [0232.433] RmEndSession () returned 0x0 [0232.434] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261008) returned 1 [0232.434] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0232.434] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0232.434] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.434] CryptDestroyKey (hKey=0x5261008) returned 1 [0232.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0232.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0232.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ed0 | out: hHeap=0x310000) returned 1 [0232.434] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0232.434] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0232.435] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.435] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0232.436] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.436] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0232.436] CloseHandle (hObject=0x668) returned 1 [0232.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0232.437] RmStartSession () returned 0x0 [0232.439] RmRegisterResources () returned 0x0 [0232.439] RmGetList () returned 0x0 [0232.848] RmShutdown () returned 0x0 [0235.687] RmEndSession () returned 0x0 [0236.016] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261148) returned 1 [0236.017] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0236.017] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", dwFileAttributes=0x20) returned 0 [0236.017] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.017] CryptDestroyKey (hKey=0x5261148) returned 1 [0236.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0236.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55718a0 | out: hHeap=0x310000) returned 1 [0236.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572a18 | out: hHeap=0x310000) returned 1 [0236.017] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0236.017] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0236.017] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.017] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0236.023] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.023] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0236.024] CloseHandle (hObject=0x668) returned 1 [0236.024] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0236.024] RmStartSession () returned 0x0 [0236.148] RmRegisterResources () returned 0x0 [0236.152] RmGetList () returned 0x0 [0236.734] RmShutdown () returned 0x0 [0237.701] RmEndSession () returned 0x0 [0238.048] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261508) returned 1 [0238.049] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0238.049] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties", dwFileAttributes=0x20) returned 1 [0238.049] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0238.049] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0238.049] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=1378) returned 1 [0238.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0238.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49eb020 [0238.067] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0238.068] ReadFile (in: hFile=0x668, lpBuffer=0x49eb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x49eb040*, lpNumberOfBytesRead=0x37afa2c*=0x562, lpOverlapped=0x0) returned 1 [0238.093] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0238.093] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0238.093] WriteFile (in: hFile=0x668, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0238.094] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0238.094] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0238.094] WriteFile (in: hFile=0x668, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0238.094] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49eb020 | out: hHeap=0x310000) returned 1 [0238.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0238.100] CloseHandle (hObject=0x668) returned 1 [0238.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0238.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0238.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0238.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0238.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0238.100] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0238.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392128 [0238.101] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0238.101] GetLastError () returned 0x0 [0238.101] SetLastError (dwErrCode=0x0) [0238.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0238.101] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.102] SetLastError (dwErrCode=0x0) [0238.102] GetLastError () returned 0x0 [0238.103] SetLastError (dwErrCode=0x0) [0238.103] GetLastError () returned 0x0 [0238.103] SetLastError (dwErrCode=0x0) [0238.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0238.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.103] GetLastError () returned 0x0 [0238.103] SetLastError (dwErrCode=0x0) [0238.103] GetLastError () returned 0x0 [0238.103] SetLastError (dwErrCode=0x0) [0238.103] GetLastError () returned 0x0 [0238.103] SetLastError (dwErrCode=0x0) [0238.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0238.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VMExNofJE4VFz9a2IHu", lpUsedDefaultChar=0x0) returned 19 [0238.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0238.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0238.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0238.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0238.103] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0238.103] WriteFile (in: hFile=0x668, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x37af9a0*=0xe66, lpOverlapped=0x0) returned 1 [0238.104] CloseHandle (hObject=0x668) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0238.104] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0238.105] CryptDestroyKey (hKey=0x5261508) returned 1 [0238.105] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0238.105] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3808 | out: hHeap=0x310000) returned 1 [0238.105] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571e88 | out: hHeap=0x310000) returned 1 [0238.105] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0238.105] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0238.105] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.105] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0238.273] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.273] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0238.273] CloseHandle (hObject=0x668) returned 1 [0238.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0238.273] RmStartSession () returned 0x0 [0238.397] RmRegisterResources () returned 0x0 [0238.397] RmGetList () returned 0x0 [0238.601] RmShutdown () returned 0x0 [0240.603] RmEndSession () returned 0x0 [0240.604] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52611c8) returned 1 [0240.604] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0240.605] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties", dwFileAttributes=0x20) returned 1 [0240.605] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0240.605] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0240.605] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=3306) returned 1 [0240.605] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b60ff0 [0240.606] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x77c0020 [0241.067] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0241.067] ReadFile (in: hFile=0x668, lpBuffer=0x77c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x77c0040*, lpNumberOfBytesRead=0x37afa2c*=0xcea, lpOverlapped=0x0) returned 1 [0241.068] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0241.068] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b61000*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b61000*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0241.068] WriteFile (in: hFile=0x668, lpBuffer=0x4b61000*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4b61000*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0241.068] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0241.068] WriteFile (in: hFile=0x668, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0241.069] WriteFile (in: hFile=0x668, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0241.069] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x77c0020 | out: hHeap=0x310000) returned 1 [0243.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b60ff0 | out: hHeap=0x310000) returned 1 [0243.414] CloseHandle (hObject=0x668) returned 1 [0243.414] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0243.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc380 [0243.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0243.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcf00 [0243.415] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0243.415] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0243.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0243.415] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0243.415] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0243.415] GetLastError () returned 0x0 [0243.416] SetLastError (dwErrCode=0x0) [0243.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0243.416] GetLastError () returned 0x0 [0243.416] SetLastError (dwErrCode=0x0) [0243.416] GetLastError () returned 0x0 [0243.416] SetLastError (dwErrCode=0x0) [0243.416] GetLastError () returned 0x0 [0243.416] SetLastError (dwErrCode=0x0) [0243.416] GetLastError () returned 0x0 [0243.416] SetLastError (dwErrCode=0x0) [0243.416] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0243.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x37af860, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HTk", lpUsedDefaultChar=0x0) returned 3 [0243.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0243.416] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0243.416] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0243.417] WriteFile (in: hFile=0x668, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x37af9a0*=0xe56, lpOverlapped=0x0) returned 1 [0243.418] CloseHandle (hObject=0x668) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0243.418] CryptDestroyKey (hKey=0x52611c8) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570fb8 | out: hHeap=0x310000) returned 1 [0243.418] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55722e8 | out: hHeap=0x310000) returned 1 [0243.418] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0243.418] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0243.418] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.418] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0243.458] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.458] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0243.458] CloseHandle (hObject=0x668) returned 1 [0243.458] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0243.458] RmStartSession () returned 0x0 [0243.460] RmRegisterResources () returned 0x0 [0243.461] RmGetList () returned 0x0 [0244.416] RmShutdown () returned 0x0 [0245.546] RmEndSession () returned 0x0 [0245.547] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261088) returned 1 [0245.547] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0245.547] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar", dwFileAttributes=0x20) returned 1 [0245.547] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0245.547] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0245.547] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=251327) returned 1 [0245.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0245.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58df020 [0246.254] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.254] GetLastError () returned 0x0 [0246.254] SetLastError (dwErrCode=0x0) [0246.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0246.255] GetLastError () returned 0x0 [0246.255] SetLastError (dwErrCode=0x0) [0246.255] GetLastError () returned 0x0 [0246.255] SetLastError (dwErrCode=0x0) [0246.255] GetLastError () returned 0x0 [0246.255] SetLastError (dwErrCode=0x0) [0246.255] GetLastError () returned 0x0 [0246.255] SetLastError (dwErrCode=0x0) [0246.255] GetLastError () returned 0x0 [0246.255] SetLastError (dwErrCode=0x0) [0246.255] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0246.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x37af860, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qL4KWuTlRzCIw", lpUsedDefaultChar=0x0) returned 13 [0246.255] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0246.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0246.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0246.255] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0246.255] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0246.256] WriteFile (in: hFile=0x668, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x37af9a0*=0xe60, lpOverlapped=0x0) returned 1 [0246.257] CloseHandle (hObject=0x668) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0246.257] CryptDestroyKey (hKey=0x5261088) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3780 | out: hHeap=0x310000) returned 1 [0246.257] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352b50 | out: hHeap=0x310000) returned 1 [0246.257] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0246.257] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0246.258] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.258] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0246.259] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.259] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0246.259] CloseHandle (hObject=0x668) returned 1 [0246.260] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0246.260] RmStartSession () returned 0x0 [0246.260] RmRegisterResources () returned 0x0 [0246.261] RmGetList () returned 0x0 [0247.159] RmShutdown () returned 0x0 [0248.059] RmEndSession () returned 0x0 [0248.060] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260cc8) returned 1 [0248.060] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0248.060] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf", dwFileAttributes=0x20) returned 1 [0248.061] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.061] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0248.061] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=242700) returned 1 [0248.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0248.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e9020 [0248.609] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0248.609] GetLastError () returned 0x0 [0248.609] SetLastError (dwErrCode=0x0) [0248.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0248.609] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.610] SetLastError (dwErrCode=0x0) [0248.610] GetLastError () returned 0x0 [0248.611] SetLastError (dwErrCode=0x0) [0248.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0248.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0248.611] GetLastError () returned 0x0 [0248.611] SetLastError (dwErrCode=0x0) [0248.611] GetLastError () returned 0x0 [0248.611] SetLastError (dwErrCode=0x0) [0248.611] GetLastError () returned 0x0 [0248.611] SetLastError (dwErrCode=0x0) [0248.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0248.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0248.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x38c548, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35nXCJ3t7DcPBvTOWYb", lpUsedDefaultChar=0x0) returned 19 [0248.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0248.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0248.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0248.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0248.611] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.612] WriteFile (in: hFile=0x668, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x37af9a0*=0xe66, lpOverlapped=0x0) returned 1 [0248.613] CloseHandle (hObject=0x668) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0248.613] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef8f0 | out: hHeap=0x310000) returned 1 [0248.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53524c0 | out: hHeap=0x310000) returned 1 [0248.613] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0248.613] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0248.613] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.613] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0248.614] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.614] ReadFile (in: hFile=0x668, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0248.614] CloseHandle (hObject=0x668) returned 1 [0248.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0248.614] RmStartSession () returned 0x0 [0248.724] RmRegisterResources () returned 0x0 [0248.724] RmGetList () returned 0x0 [0248.821] RmShutdown () returned 0x0 [0250.047] RmEndSession () returned 0x0 [0250.048] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261448) returned 1 [0250.048] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0250.048] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties", dwFileAttributes=0x20) returned 1 [0250.048] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0250.048] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0250.048] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=56) returned 1 [0250.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0250.049] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b04020 [0250.083] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.083] SetLastError (dwErrCode=0x0) [0250.083] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6f8 [0250.084] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.084] SetLastError (dwErrCode=0x0) [0250.084] GetLastError () returned 0x0 [0250.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0250.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0250.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mq0Gric0JR23PHFSN5QG4V5474", cchWideChar=26, lpMultiByteStr=0x38c3b8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mq0Gric0JR23PHFSN5QG4V5474", lpUsedDefaultChar=0x0) returned 26 [0250.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ed650 | out: hHeap=0x310000) returned 1 [0250.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0250.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0250.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0250.085] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0250.086] WriteFile (in: hFile=0x4fc, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x37af9a0*=0xe6d, lpOverlapped=0x0) returned 1 [0250.086] CloseHandle (hObject=0x4fc) returned 1 [0250.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0250.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0250.087] CryptDestroyKey (hKey=0x5261448) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3560 | out: hHeap=0x310000) returned 1 [0250.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353460 | out: hHeap=0x310000) returned 1 [0250.087] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0250.087] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0250.087] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.087] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0250.120] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.120] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0250.120] CloseHandle (hObject=0x4fc) returned 1 [0250.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0250.120] RmStartSession () returned 0x0 [0250.122] RmRegisterResources () returned 0x0 [0250.122] RmGetList () returned 0x0 [0251.783] RmShutdown () returned 0x0 [0252.956] RmEndSession () returned 0x0 [0252.980] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52615c8) returned 1 [0252.980] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0252.980] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties", dwFileAttributes=0x20) returned 1 [0252.980] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0252.980] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0252.980] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=2455) returned 1 [0252.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0252.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f9020 [0253.002] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0253.002] ReadFile (in: hFile=0x4fc, lpBuffer=0x76f9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x76f9040*, lpNumberOfBytesRead=0x37afa2c*=0x997, lpOverlapped=0x0) returned 1 [0253.027] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0253.027] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0253.027] WriteFile (in: hFile=0x4fc, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0253.029] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0253.029] WriteFile (in: hFile=0x4fc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0253.030] WriteFile (in: hFile=0x4fc, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0253.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f9020 | out: hHeap=0x310000) returned 1 [0253.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d6a020 | out: hHeap=0x310000) returned 1 [0253.035] CloseHandle (hObject=0x4fc) returned 1 [0253.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0253.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0253.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0253.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0253.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0253.035] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0253.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0253.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0253.036] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0253.036] GetLastError () returned 0x0 [0253.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x37af860, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0253.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0253.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0253.036] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0253.037] WriteFile (in: hFile=0x4fc, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x37af9a0*=0xe57, lpOverlapped=0x0) returned 1 [0253.038] CloseHandle (hObject=0x4fc) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0253.038] CryptDestroyKey (hKey=0x52615c8) returned 1 [0253.038] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0253.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3670 | out: hHeap=0x310000) returned 1 [0253.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352fb0 | out: hHeap=0x310000) returned 1 [0253.039] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0253.039] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0253.039] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.039] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0253.590] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.590] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0253.590] CloseHandle (hObject=0x4fc) returned 1 [0253.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0253.591] RmStartSession () returned 0x0 [0253.591] RmRegisterResources () returned 0x0 [0254.583] RmGetList () returned 0x0 [0255.662] RmShutdown () returned 0x0 [0256.977] RmEndSession () returned 0x0 [0256.977] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261188) returned 1 [0256.977] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0256.978] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security", dwFileAttributes=0x20) returned 1 [0256.978] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0256.978] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0256.978] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=36524) returned 1 [0256.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b6b008 [0256.978] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2c020 [0257.877] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0257.877] GetLastError () returned 0x0 [0257.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0257.877] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0257.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x38c098, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Jqd1nQTWMi6MgqEEJIg", lpUsedDefaultChar=0x0) returned 20 [0257.877] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0257.877] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0257.877] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0257.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0257.878] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0257.878] WriteFile (in: hFile=0x4fc, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x37af9a0*=0xe67, lpOverlapped=0x0) returned 1 [0257.879] CloseHandle (hObject=0x4fc) returned 1 [0257.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0257.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0257.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0257.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0257.880] CryptDestroyKey (hKey=0x5261188) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0257.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353140 | out: hHeap=0x310000) returned 1 [0257.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0257.880] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0257.881] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.881] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0257.882] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.882] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0257.882] CloseHandle (hObject=0x4fc) returned 1 [0257.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0ab40 [0257.882] RmStartSession () returned 0x0 [0257.883] RmRegisterResources () returned 0x0 [0257.884] RmGetList () returned 0x0 [0258.586] RmShutdown () returned 0x0 [0259.674] RmEndSession () returned 0x0 [0259.676] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261008) returned 1 [0259.676] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0259.676] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0259.676] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0259.676] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0259.677] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=800867) returned 1 [0259.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0259.677] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b1020 [0260.726] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0260.726] GetLastError () returned 0x0 [0260.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0260.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0260.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c3b8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0260.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x611a080 | out: hHeap=0x310000) returned 1 [0260.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0260.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eb8d0 [0260.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0260.726] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0260.727] WriteFile (in: hFile=0x4fc, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x37af9a0*=0xe71, lpOverlapped=0x0) returned 1 [0260.728] CloseHandle (hObject=0x4fc) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04138 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f630 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0adf8 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0260.728] CryptDestroyKey (hKey=0x5261008) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0ab40 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba99d0 | out: hHeap=0x310000) returned 1 [0260.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53518e0 | out: hHeap=0x310000) returned 1 [0260.728] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0260.728] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0260.730] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.730] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0260.731] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.732] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0260.732] CloseHandle (hObject=0x4fc) returned 1 [0260.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0ab40 [0260.732] RmStartSession () returned 0x0 [0261.109] RmRegisterResources () returned 0x0 [0261.109] RmGetList () returned 0x0 [0261.335] RmShutdown () returned 0x0 [0261.609] RmEndSession () returned 0x0 [0261.678] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52611c8) returned 1 [0261.678] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0261.678] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0261.678] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0261.678] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0261.678] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=215883) returned 1 [0261.678] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c8f270 [0261.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58d2020 [0261.764] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0261.764] GetLastError () returned 0x0 [0261.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0261.764] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x37af860, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3", lpUsedDefaultChar=0x0) returned 1 [0261.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0261.764] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0261.764] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0261.765] WriteFile (in: hFile=0x564, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x37af9a0*=0xe54, lpOverlapped=0x0) returned 1 [0261.766] CloseHandle (hObject=0x564) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b0b0 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f440 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09af0 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0261.766] CryptDestroyKey (hKey=0x52611c8) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0ab40 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348e30 | out: hHeap=0x310000) returned 1 [0261.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351de0 | out: hHeap=0x310000) returned 1 [0261.767] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0261.767] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0261.767] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.767] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0262.383] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.383] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0262.383] CloseHandle (hObject=0x564) returned 1 [0262.384] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b0b0 [0262.384] RmStartSession () returned 0x0 [0262.895] RmRegisterResources () returned 0x0 [0262.895] RmGetList () returned 0x0 [0263.043] RmShutdown () returned 0x0 [0263.930] RmEndSession () returned 0x0 [0263.930] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x52618c8) returned 1 [0263.930] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0263.931] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0263.931] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0263.931] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0263.931] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=65002) returned 1 [0263.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5ceaf50 [0263.931] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6586020 [0266.585] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0266.586] GetLastError () returned 0x0 [0266.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.586] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x37af860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.586] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0266.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0266.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0266.586] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0266.586] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0266.587] WriteFile (in: hFile=0x500, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x37af9a0*=0xe61, lpOverlapped=0x0) returned 1 [0266.587] CloseHandle (hObject=0x500) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5760 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5399078 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4c80 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0266.588] CryptDestroyKey (hKey=0x52618c8) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b0b0 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348350 | out: hHeap=0x310000) returned 1 [0266.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19560 | out: hHeap=0x310000) returned 1 [0266.588] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0266.588] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0266.588] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.588] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0266.590] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.590] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0266.590] CloseHandle (hObject=0x500) returned 1 [0266.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0266.590] RmStartSession () returned 0x0 [0266.738] RmRegisterResources () returned 0x0 [0266.739] RmGetList () returned 0x0 [0266.861] RmShutdown () returned 0x0 [0268.387] RmEndSession () returned 0x0 [0268.388] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260d88) returned 1 [0268.388] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0268.388] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml", dwFileAttributes=0x220) returned 1 [0268.389] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0268.389] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0268.389] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=2173046) returned 1 [0268.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0268.389] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x562d020 [0270.691] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0270.691] GetLastError () returned 0x0 [0270.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0270.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0270.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", cchWideChar=30, lpMultiByteStr=0x38c520, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kPjILt9xxLxU8F9CyeiCS1vbDllTnE", lpUsedDefaultChar=0x0) returned 30 [0270.691] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89eb0 | out: hHeap=0x310000) returned 1 [0270.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0270.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0270.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93738 [0270.691] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0270.692] WriteFile (in: hFile=0x574, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x37af9a0*=0xe71, lpOverlapped=0x0) returned 1 [0270.693] CloseHandle (hObject=0x574) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0270.693] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0270.693] CryptDestroyKey (hKey=0x5260d88) returned 1 [0270.694] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0270.694] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef500 | out: hHeap=0x310000) returned 1 [0270.694] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a70 | out: hHeap=0x310000) returned 1 [0270.694] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0270.694] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0270.701] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.701] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0270.709] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.709] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0270.709] CloseHandle (hObject=0x630) returned 1 [0270.709] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0270.709] RmStartSession () returned 0x0 [0270.710] RmRegisterResources () returned 0x0 [0270.711] RmGetList () returned 0x0 [0275.831] RmShutdown () returned 0x0 [0277.314] RmEndSession () returned 0x0 [0277.315] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260e08) returned 1 [0277.315] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0277.315] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF", dwFileAttributes=0x220) returned 1 [0277.315] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0277.315] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0277.315] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=8582) returned 1 [0277.315] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0277.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57c3020 [0278.173] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0278.173] ReadFile (in: hFile=0x630, lpBuffer=0x57c3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x57c3040*, lpNumberOfBytesRead=0x37afa2c*=0x2186, lpOverlapped=0x0) returned 1 [0278.174] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0278.174] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0278.174] WriteFile (in: hFile=0x630, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0278.175] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0278.175] WriteFile (in: hFile=0x630, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0278.175] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0278.175] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0278.175] WriteFile (in: hFile=0x630, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0278.175] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57c3020 | out: hHeap=0x310000) returned 1 [0279.072] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b47008 | out: hHeap=0x310000) returned 1 [0279.072] CloseHandle (hObject=0x630) returned 1 [0279.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0279.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1d60 [0279.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0279.072] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0279.073] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1d60 | out: hHeap=0x310000) returned 1 [0279.073] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0279.073] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0279.073] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0279.074] GetLastError () returned 0x0 [0279.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0279.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0279.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x38c3e0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5PaBVzxQBGd15AjyqsacvL0n", lpUsedDefaultChar=0x0) returned 24 [0279.074] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7b9a0 | out: hHeap=0x310000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0279.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0279.074] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0279.074] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0279.075] WriteFile (in: hFile=0x630, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x37af9a0*=0xe6b, lpOverlapped=0x0) returned 1 [0279.076] CloseHandle (hObject=0x630) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0279.076] CryptDestroyKey (hKey=0x5260e08) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5c88 | out: hHeap=0x310000) returned 1 [0279.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2ff0 | out: hHeap=0x310000) returned 1 [0279.076] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0279.076] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0279.076] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.076] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0279.097] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.097] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0279.097] CloseHandle (hObject=0x630) returned 1 [0279.097] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0279.097] RmStartSession () returned 0x0 [0279.098] RmRegisterResources () returned 0x0 [0279.098] RmGetList () returned 0x0 [0279.181] RmShutdown () returned 0x0 [0280.827] RmEndSession () returned 0x0 [0280.828] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x35de48) returned 1 [0280.828] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0280.828] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF", dwFileAttributes=0x220) returned 1 [0280.828] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0280.828] CryptEncrypt (in: hKey=0x35de48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0280.828] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=8492) returned 1 [0280.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0280.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621f020 [0281.643] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0281.643] ReadFile (in: hFile=0x630, lpBuffer=0x621f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x621f040*, lpNumberOfBytesRead=0x37afa2c*=0x212c, lpOverlapped=0x0) returned 1 [0281.644] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0281.644] CryptEncrypt (in: hKey=0x35de48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0281.645] WriteFile (in: hFile=0x630, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0281.645] CryptEncrypt (in: hKey=0x35de48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0281.645] WriteFile (in: hFile=0x630, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0281.645] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0281.645] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0281.645] WriteFile (in: hFile=0x630, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0281.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621f020 | out: hHeap=0x310000) returned 1 [0281.650] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0281.650] CloseHandle (hObject=0x630) returned 1 [0281.650] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0281.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0281.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0281.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0281.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0281.651] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4ab8 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0281.652] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0281.652] GetLastError () returned 0x0 [0281.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0281.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x38c3e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", lpUsedDefaultChar=0x0) returned 31 [0281.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e82e30 | out: hHeap=0x310000) returned 1 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0281.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0281.653] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0281.653] WriteFile (in: hFile=0x630, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x37af9a0*=0xe72, lpOverlapped=0x0) returned 1 [0281.654] CloseHandle (hObject=0x630) returned 1 [0281.654] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0281.654] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0281.654] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0281.654] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4ab8 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0281.655] CryptDestroyKey (hKey=0x35de48) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94930 | out: hHeap=0x310000) returned 1 [0281.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1bf0 | out: hHeap=0x310000) returned 1 [0281.655] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0281.655] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0281.655] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.655] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0281.657] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.657] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0281.657] CloseHandle (hObject=0x630) returned 1 [0281.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0281.657] RmStartSession () returned 0x0 [0281.658] RmRegisterResources () returned 0x0 [0281.659] RmGetList () returned 0x0 [0282.289] RmShutdown () returned 0x0 [0286.445] RmEndSession () returned 0x0 [0286.446] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261588) returned 1 [0286.446] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0286.446] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF", dwFileAttributes=0x220) returned 1 [0286.446] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0286.446] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0286.446] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=4870) returned 1 [0286.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0286.446] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c3020 [0287.051] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0287.051] ReadFile (in: hFile=0x630, lpBuffer=0x65c3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x65c3040*, lpNumberOfBytesRead=0x37afa2c*=0x1306, lpOverlapped=0x0) returned 1 [0287.101] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0287.101] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0287.101] WriteFile (in: hFile=0x630, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0287.101] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0287.101] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0287.102] WriteFile (in: hFile=0x630, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0287.102] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c3020 | out: hHeap=0x310000) returned 1 [0287.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0287.107] CloseHandle (hObject=0x630) returned 1 [0287.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0287.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c32f0 [0287.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a48f0 [0287.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2040 [0287.107] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c32f0 | out: hHeap=0x310000) returned 1 [0287.107] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4690 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0287.108] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0287.108] GetLastError () returned 0x0 [0287.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0287.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x38c520, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ROQXe5ltuBK41ZqGEav", lpUsedDefaultChar=0x0) returned 19 [0287.108] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b9d0 | out: hHeap=0x310000) returned 1 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0287.108] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0287.108] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0287.109] WriteFile (in: hFile=0x630, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x37af9a0*=0xe66, lpOverlapped=0x0) returned 1 [0287.110] CloseHandle (hObject=0x630) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4690 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2040 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a48f0 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0287.110] CryptDestroyKey (hKey=0x5261588) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94800 | out: hHeap=0x310000) returned 1 [0287.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2320 | out: hHeap=0x310000) returned 1 [0287.110] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0287.111] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0287.111] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.111] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0287.170] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.170] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0287.170] CloseHandle (hObject=0x630) returned 1 [0287.170] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4728 [0287.170] RmStartSession () returned 0x0 [0287.311] RmRegisterResources () returned 0x0 [0287.315] RmGetList () returned 0x0 [0288.245] RmShutdown () returned 0x0 [0290.695] RmEndSession () returned 0x0 [0290.951] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5260b48) returned 1 [0290.951] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0290.951] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF", dwFileAttributes=0x220) returned 1 [0290.951] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0290.951] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0290.951] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=9710) returned 1 [0290.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0290.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3e020 [0290.970] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0290.970] ReadFile (in: hFile=0x630, lpBuffer=0x4d3e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x4d3e040*, lpNumberOfBytesRead=0x37afa2c*=0x25ee, lpOverlapped=0x0) returned 1 [0291.046] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0291.046] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0291.046] WriteFile (in: hFile=0x630, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0291.047] CryptEncrypt (in: hKey=0x5260b48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0291.047] WriteFile (in: hFile=0x630, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0291.047] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0291.047] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0291.047] WriteFile (in: hFile=0x630, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0291.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d3e020 | out: hHeap=0x310000) returned 1 [0291.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0291.053] CloseHandle (hObject=0x630) returned 1 [0291.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0291.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0291.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5a28 [0291.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0291.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0291.053] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0291.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5698 [0291.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0291.055] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0291.055] GetLastError () returned 0x0 [0291.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0291.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x37af860, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0291.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0291.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0291.055] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0291.056] WriteFile (in: hFile=0x630, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x37af9a0*=0xe54, lpOverlapped=0x0) returned 1 [0291.057] CloseHandle (hObject=0x630) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5698 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5a28 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0291.057] CryptDestroyKey (hKey=0x5260b48) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4728 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95640 | out: hHeap=0x310000) returned 1 [0291.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2be0 | out: hHeap=0x310000) returned 1 [0291.057] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0291.058] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0291.058] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.058] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0291.194] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.194] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0291.194] CloseHandle (hObject=0x630) returned 1 [0291.195] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4db0 [0291.195] RmStartSession () returned 0x0 [0291.325] RmRegisterResources () returned 0x0 [0291.326] RmGetList () returned 0x0 [0291.433] RmShutdown () returned 0x0 [0291.532] RmEndSession () returned 0x0 [0291.533] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x35db88) returned 1 [0291.533] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0291.533] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF", dwFileAttributes=0x220) returned 1 [0291.533] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0291.534] CryptEncrypt (in: hKey=0x35db88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0291.534] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=14444) returned 1 [0291.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c0f008 [0291.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621c020 [0291.554] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0291.554] ReadFile (in: hFile=0x560, lpBuffer=0x621c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x621c040*, lpNumberOfBytesRead=0x37afa2c*=0x386c, lpOverlapped=0x0) returned 1 [0291.556] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0291.556] CryptEncrypt (in: hKey=0x35db88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0291.556] WriteFile (in: hFile=0x560, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0291.557] CryptEncrypt (in: hKey=0x35db88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0291.557] WriteFile (in: hFile=0x560, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0291.557] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0291.557] WriteFile (in: hFile=0x560, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0291.557] WriteFile (in: hFile=0x560, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0291.557] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621c020 | out: hHeap=0x310000) returned 1 [0291.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c0f008 | out: hHeap=0x310000) returned 1 [0291.562] CloseHandle (hObject=0x560) returned 1 [0291.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0291.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0291.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5b58 [0291.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0291.563] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0291.563] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0291.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5730 [0291.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0291.564] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0291.564] GetLastError () returned 0x0 [0291.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0291.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x37af860, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0291.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0291.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0291.564] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0291.565] WriteFile (in: hFile=0x560, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x37af9a0*=0xe54, lpOverlapped=0x0) returned 1 [0291.566] CloseHandle (hObject=0x560) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5730 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5b58 | out: hHeap=0x310000) returned 1 [0291.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0291.566] CryptDestroyKey (hKey=0x35db88) returned 1 [0291.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4db0 | out: hHeap=0x310000) returned 1 [0291.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53066b0 | out: hHeap=0x310000) returned 1 [0291.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a3f8 | out: hHeap=0x310000) returned 1 [0291.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0291.567] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0291.567] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.567] ReadFile (in: hFile=0x560, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0292.283] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.284] ReadFile (in: hFile=0x560, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0292.284] CloseHandle (hObject=0x560) returned 1 [0292.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4db0 [0292.284] RmStartSession () returned 0x0 [0292.587] RmRegisterResources () returned 0x0 [0292.587] RmGetList () returned 0x0 [0292.896] RmShutdown () returned 0x0 [0295.163] RmEndSession () returned 0x0 [0295.199] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x37afb2c | out: phKey=0x37afb2c*=0x5261508) returned 1 [0295.199] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0295.199] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF", dwFileAttributes=0x220) returned 1 [0295.199] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0295.199] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x37af98c*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x37af98c*=0x2000) returned 1 [0295.200] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x37afa24 | out: lpFileSize=0x37afa24*=4708) returned 1 [0295.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0295.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ee020 [0295.219] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0295.219] ReadFile (in: hFile=0x560, lpBuffer=0x49ee040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x49ee040*, lpNumberOfBytesRead=0x37afa2c*=0x1264, lpOverlapped=0x0) returned 1 [0295.244] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa14 | out: lpNewFilePointer=0x0) returned 1 [0295.244] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x37af9a0*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x37af9a0*=0x2000) returned 1 [0295.244] WriteFile (in: hFile=0x560, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x37afa30*=0x2000, lpOverlapped=0x0) returned 1 [0295.244] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afa1c | out: lpNewFilePointer=0x0) returned 1 [0295.244] WriteFile (in: hFile=0x560, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x37afa30*=0x200, lpOverlapped=0x0) returned 1 [0295.245] WriteFile (in: hFile=0x560, lpBuffer=0x37af9cc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x37afa30, lpOverlapped=0x0 | out: lpBuffer=0x37af9cc*, lpNumberOfBytesWritten=0x37afa30*=0x18, lpOverlapped=0x0) returned 1 [0295.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ee020 | out: hHeap=0x310000) returned 1 [0295.250] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0295.250] CloseHandle (hObject=0x560) returned 1 [0295.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0295.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0380 [0295.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95640 [0295.250] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf3b0 [0295.250] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0380 | out: hHeap=0x310000) returned 1 [0295.250] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0295.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c959d0 [0295.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0295.251] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x37af800 | out: lpSystemTimeAsFileTime=0x37af800) [0295.251] GetLastError () returned 0x0 [0295.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0295.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x37af860, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrHQog3L8507y", lpUsedDefaultChar=0x0) returned 13 [0295.251] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0295.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0295.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0295.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0295.252] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0295.252] WriteFile (in: hFile=0x560, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x37af9a0, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x37af9a0*=0xe60, lpOverlapped=0x0) returned 1 [0295.253] CloseHandle (hObject=0x560) returned 1 [0295.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0295.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0295.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0295.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0295.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x310000) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95640 | out: hHeap=0x310000) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0295.254] CryptDestroyKey (hKey=0x5261508) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4db0 | out: hHeap=0x310000) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306f98 | out: hHeap=0x310000) returned 1 [0295.254] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609f98 | out: hHeap=0x310000) returned 1 [0295.254] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x37afb60, lpCompletionKey=0x37afb64, lpOverlapped=0x37afb5c) returned 1 [0295.254] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0295.254] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa30 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.254] ReadFile (in: hFile=0x560, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa2c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa2c*=0x18, lpOverlapped=0x0) returned 1 [0296.133] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37afa38 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.133] ReadFile (in: hFile=0x560, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x37afa20, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x37afa20*=0x18, lpOverlapped=0x0) returned 1 [0296.133] CloseHandle (hObject=0x560) returned 1 [0296.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95cc8 [0296.133] RmStartSession () returned 0x0 [0296.136] RmRegisterResources () returned 0x0 [0296.140] RmGetList () returned 0x0 [0298.183] RmShutdown () returned 0x0 [0299.116] RmEndSession () Thread: id = 13 os_tid = 0x10d0 [0068.623] GetLastError () returned 0x57 [0068.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x353788 [0068.624] SetLastError (dwErrCode=0x57) [0068.624] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0080.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0081.326] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0085.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0100.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0108.721] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0114.117] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0125.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0126.573] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0127.597] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0128.614] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0129.636] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0130.685] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0131.702] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0132.740] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 0 [0133.784] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0134.106] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0134.106] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.106] ReadFile (in: hFile=0x4bc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0134.110] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.110] ReadFile (in: hFile=0x4bc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0134.110] CloseHandle (hObject=0x4bc) returned 1 [0134.110] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae00 [0134.110] RmStartSession () returned 0x0 [0134.116] RmRegisterResources () returned 0x0 [0134.122] RmGetList () returned 0x0 [0134.632] RmShutdown () returned 0x0 [0135.968] RmEndSession () returned 0x0 [0136.909] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261008) returned 1 [0136.910] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0136.910] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x20) returned 1 [0136.910] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0136.910] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0136.911] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=6004) returned 1 [0136.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3ede80 [0136.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x572e020 [0136.942] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0136.942] ReadFile (in: hFile=0x4c4, lpBuffer=0x572e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x572e040*, lpNumberOfBytesRead=0x38efa40*=0x1774, lpOverlapped=0x0) returned 1 [0137.010] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0137.010] CryptEncrypt (in: hKey=0x5261008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edea0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edea0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0137.010] WriteFile (in: hFile=0x4c4, lpBuffer=0x3edea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3edea0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0137.011] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0137.011] WriteFile (in: hFile=0x4c4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0137.011] WriteFile (in: hFile=0x4c4, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0137.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x572e020 | out: hHeap=0x310000) returned 1 [0137.016] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ede80 | out: hHeap=0x310000) returned 1 [0137.016] CloseHandle (hObject=0x4c4) returned 1 [0137.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0137.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c9a0 [0137.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b0d0 [0137.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c740 [0137.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c9a0 | out: hHeap=0x310000) returned 1 [0137.018] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.bdcddcbaad"), dwFlags=0x1) returned 1 [0137.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b058 [0137.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0137.019] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0137.019] GetLastError () returned 0x0 [0137.019] SetLastError (dwErrCode=0x0) [0137.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0137.020] GetLastError () returned 0x0 [0137.020] SetLastError (dwErrCode=0x0) [0137.020] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0137.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QVBnheip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0137.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QVBnheip", cchWideChar=9, lpMultiByteStr=0x38ef870, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2QVBnheip", lpUsedDefaultChar=0x0) returned 9 [0137.020] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0137.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x520b6e0 [0137.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060be0 [0137.021] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0137.021] WriteFile (in: hFile=0x4c4, lpBuffer=0x520b6e0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x520b6e0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe5c, lpOverlapped=0x0) returned 1 [0137.022] CloseHandle (hObject=0x4c4) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060be0 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x520b6e0 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c740 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b0d0 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0137.023] CryptDestroyKey (hKey=0x5261008) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae00 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac20 | out: hHeap=0x310000) returned 1 [0137.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365408 | out: hHeap=0x310000) returned 1 [0137.023] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0137.023] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0137.024] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.024] ReadFile (in: hFile=0x4c4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0137.147] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.147] ReadFile (in: hFile=0x4c4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0137.147] CloseHandle (hObject=0x4c4) returned 1 [0137.147] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060b78 [0137.148] RmStartSession () returned 0x0 [0137.965] RmRegisterResources () returned 0x0 [0137.965] RmGetList () returned 0x0 [0138.275] RmShutdown () returned 0x0 [0144.130] RmEndSession () returned 0x0 [0144.131] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261908) returned 1 [0144.131] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0144.131] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0144.132] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0144.132] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0144.132] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=82346) returned 1 [0144.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3ebe78 [0144.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6727020 [0144.502] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0144.502] ReadFile (in: hFile=0x508, lpBuffer=0x6727040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6727040*, lpNumberOfBytesRead=0x38efa40*=0x141aa, lpOverlapped=0x0) returned 1 [0144.506] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0144.506] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.506] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.506] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.506] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.506] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.506] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.506] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.506] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.506] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.506] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.507] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3ebe80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0144.507] WriteFile (in: hFile=0x508, lpBuffer=0x3ebe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x3ebe80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0144.508] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0144.508] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0144.508] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0144.508] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6727020 | out: hHeap=0x310000) returned 1 [0144.973] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebe78 | out: hHeap=0x310000) returned 1 [0144.973] CloseHandle (hObject=0x508) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0144.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0144.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0144.975] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0144.975] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0144.975] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1031\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0144.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0144.976] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0144.976] GetLastError () returned 0x0 [0144.976] SetLastError (dwErrCode=0x0) [0144.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0144.976] GetLastError () returned 0x0 [0144.976] SetLastError (dwErrCode=0x0) [0144.976] GetLastError () returned 0x0 [0144.976] SetLastError (dwErrCode=0x0) [0144.976] GetLastError () returned 0x0 [0144.976] SetLastError (dwErrCode=0x0) [0144.976] GetLastError () returned 0x0 [0144.976] SetLastError (dwErrCode=0x0) [0144.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0144.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0144.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x38ef870, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NQM", lpUsedDefaultChar=0x0) returned 3 [0144.977] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0144.977] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5364de8 [0144.977] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1031\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0144.978] WriteFile (in: hFile=0x508, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x38ef9b4*=0xe56, lpOverlapped=0x0) returned 1 [0144.978] CloseHandle (hObject=0x508) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5364de8 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0144.979] CryptDestroyKey (hKey=0x5261908) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060b78 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0144.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365778 | out: hHeap=0x310000) returned 1 [0144.979] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0144.979] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0144.980] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.980] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0145.001] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.001] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0145.001] CloseHandle (hObject=0x508) returned 1 [0145.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0145.002] RmStartSession () returned 0x0 [0145.005] RmRegisterResources () returned 0x0 [0145.009] RmGetList () returned 0x0 [0146.163] RmShutdown () returned 0x0 [0147.693] RmEndSession () returned 0x0 [0147.693] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260d48) returned 1 [0147.693] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0147.694] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0147.694] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0147.694] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0147.694] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=82374) returned 1 [0147.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54ad9f8 [0147.694] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6735020 [0147.904] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0147.904] ReadFile (in: hFile=0x508, lpBuffer=0x6735040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6735040*, lpNumberOfBytesRead=0x38efa40*=0x141c6, lpOverlapped=0x0) returned 1 [0147.906] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0147.906] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.906] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.907] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.908] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.908] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.908] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.908] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.908] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.908] CryptEncrypt (in: hKey=0x5260d48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x54ada00*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0147.908] WriteFile (in: hFile=0x508, lpBuffer=0x54ada00*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x54ada00*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0147.908] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0147.908] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0147.909] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0147.909] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6735020 | out: hHeap=0x310000) returned 1 [0148.077] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ad9f8 | out: hHeap=0x310000) returned 1 [0148.077] CloseHandle (hObject=0x508) returned 1 [0148.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0148.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0148.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0148.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb2d0 [0148.080] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0148.080] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1045\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0148.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0148.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397de0 [0148.081] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0148.081] GetLastError () returned 0x0 [0148.081] SetLastError (dwErrCode=0x0) [0148.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0148.081] GetLastError () returned 0x0 [0148.081] SetLastError (dwErrCode=0x0) [0148.081] GetLastError () returned 0x0 [0148.081] SetLastError (dwErrCode=0x0) [0148.081] GetLastError () returned 0x0 [0148.081] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] GetLastError () returned 0x0 [0148.082] SetLastError (dwErrCode=0x0) [0148.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0148.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x38ef870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmgdxOo64GZeM", lpUsedDefaultChar=0x0) returned 13 [0148.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0148.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0148.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0148.082] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19768 [0148.083] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0148.083] WriteFile (in: hFile=0x508, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x38ef9b4*=0xe60, lpOverlapped=0x0) returned 1 [0148.084] CloseHandle (hObject=0x508) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397de0 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb2d0 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0148.085] CryptDestroyKey (hKey=0x5260d48) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0148.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c00 | out: hHeap=0x310000) returned 1 [0148.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0148.085] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0148.085] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.085] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0148.102] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.102] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0148.102] CloseHandle (hObject=0x508) returned 1 [0148.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0148.102] RmStartSession () returned 0x0 [0148.105] RmRegisterResources () returned 0x0 [0148.105] RmGetList () returned 0x0 [0151.510] RmShutdown () returned 0x0 [0155.656] RmEndSession () returned 0x0 [0156.157] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260c08) returned 1 [0156.157] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0156.157] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x80) returned 1 [0156.158] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0156.158] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0156.158] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=6309) returned 1 [0156.158] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0156.158] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57f8020 [0156.181] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0156.181] ReadFile (in: hFile=0x508, lpBuffer=0x57f8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x57f8040*, lpNumberOfBytesRead=0x38efa40*=0x18a5, lpOverlapped=0x0) returned 1 [0156.234] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0156.234] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0156.235] WriteFile (in: hFile=0x508, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0156.235] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0156.235] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0156.235] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0156.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57f8020 | out: hHeap=0x310000) returned 1 [0158.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0158.036] CloseHandle (hObject=0x508) returned 1 [0158.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0158.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0158.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0158.037] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0158.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0158.037] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\3076\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0158.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0158.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979a8 [0158.038] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0158.038] GetLastError () returned 0x0 [0158.038] SetLastError (dwErrCode=0x0) [0158.038] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0158.038] GetLastError () returned 0x0 [0158.038] SetLastError (dwErrCode=0x0) [0158.038] GetLastError () returned 0x0 [0158.038] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] GetLastError () returned 0x0 [0158.039] SetLastError (dwErrCode=0x0) [0158.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0158.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0WFjmsBgTPgpX", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0158.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0WFjmsBgTPgpX", cchWideChar=13, lpMultiByteStr=0x38ef870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0WFjmsBgTPgpX", lpUsedDefaultChar=0x0) returned 13 [0158.039] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0158.039] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0158.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0158.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0158.040] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\3076\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0158.041] WriteFile (in: hFile=0x508, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x38ef9b4*=0xe60, lpOverlapped=0x0) returned 1 [0158.042] CloseHandle (hObject=0x508) returned 1 [0158.042] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979a8 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0158.043] CryptDestroyKey (hKey=0x5260c08) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5680 | out: hHeap=0x310000) returned 1 [0158.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c198d0 | out: hHeap=0x310000) returned 1 [0158.043] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0158.043] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0158.043] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.043] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0158.045] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.045] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0158.045] CloseHandle (hObject=0x508) returned 1 [0158.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3990e8 [0158.045] RmStartSession () returned 0x0 [0158.048] RmRegisterResources () returned 0x0 [0158.051] RmGetList () returned 0x0 [0161.710] RmShutdown () returned 0x0 [0166.684] RmEndSession () returned 0x0 [0166.685] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260c88) returned 1 [0166.685] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0166.685] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x80) returned 1 [0166.685] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0166.685] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0166.685] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=41080) returned 1 [0166.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5209048 [0166.686] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6c75020 [0167.530] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0167.530] ReadFile (in: hFile=0x508, lpBuffer=0x6c75040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6c75040*, lpNumberOfBytesRead=0x38efa40*=0xa078, lpOverlapped=0x0) returned 1 [0167.532] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0167.532] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.532] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.532] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.532] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.532] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.532] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.532] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.532] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.533] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.533] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.533] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5209060*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0167.533] WriteFile (in: hFile=0x508, lpBuffer=0x5209060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5209060*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0167.533] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0167.533] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0167.533] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0167.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c75020 | out: hHeap=0x310000) returned 1 [0169.127] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5209048 | out: hHeap=0x310000) returned 1 [0169.127] CloseHandle (hObject=0x508) returned 1 [0169.129] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0169.129] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f02e8 [0169.129] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0169.129] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0169.130] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f02e8 | out: hHeap=0x310000) returned 1 [0169.130] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\\\588bce7c90097ed212\\SplashScreen.bmp.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.bdcddcbaad"), dwFlags=0x1) returned 1 [0169.130] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399878 [0169.130] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0169.131] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3e68 [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.131] SetLastError (dwErrCode=0x0) [0169.131] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7a0 [0169.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0169.132] GetLastError () returned 0x0 [0169.132] SetLastError (dwErrCode=0x0) [0169.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3e68 | out: hHeap=0x310000) returned 1 [0169.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0169.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x38c3e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vsPfwZLZiAU4bA46v", lpUsedDefaultChar=0x0) returned 17 [0169.256] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0169.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0169.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0169.256] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0169.257] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0169.258] WriteFile (in: hFile=0x508, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x38ef9b4*=0xe64, lpOverlapped=0x0) returned 1 [0169.259] CloseHandle (hObject=0x508) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399878 | out: hHeap=0x310000) returned 1 [0169.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0169.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0169.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0169.261] CryptDestroyKey (hKey=0x5260c88) returned 1 [0169.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0169.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399350 | out: hHeap=0x310000) returned 1 [0169.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365bd8 | out: hHeap=0x310000) returned 1 [0169.261] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0169.261] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0169.261] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.261] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0169.268] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.268] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0169.268] CloseHandle (hObject=0x508) returned 1 [0169.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3d58 [0169.268] RmStartSession () returned 0x0 [0169.270] RmRegisterResources () returned 0x0 [0169.274] RmGetList () returned 0x0 [0170.293] RmShutdown () returned 0x0 [0172.009] RmEndSession () returned 0x0 [0172.010] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260f48) returned 1 [0172.010] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0172.010] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0172.010] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0172.010] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0172.010] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=69632) returned 1 [0172.010] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5e3de48 [0172.011] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6d88020 [0172.528] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0172.528] ReadFile (in: hFile=0x508, lpBuffer=0x6d88040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6d88040*, lpNumberOfBytesRead=0x38efa40*=0x11000, lpOverlapped=0x0) returned 1 [0172.530] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0172.530] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.531] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.531] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.532] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.532] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.532] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3de60*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0172.532] WriteFile (in: hFile=0x508, lpBuffer=0x5e3de60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5e3de60*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0172.532] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0172.532] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0172.532] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0172.532] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6d88020 | out: hHeap=0x310000) returned 1 [0175.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e3de48 | out: hHeap=0x310000) returned 1 [0175.047] CloseHandle (hObject=0x508) returned 1 [0175.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0175.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321bb0 [0175.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0175.053] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321230 [0175.053] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321bb0 | out: hHeap=0x310000) returned 1 [0175.053] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0175.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4330 [0175.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0175.054] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0175.054] GetLastError () returned 0x0 [0175.054] SetLastError (dwErrCode=0x0) [0175.054] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0175.054] GetLastError () returned 0x0 [0175.054] SetLastError (dwErrCode=0x0) [0175.054] GetLastError () returned 0x0 [0175.054] SetLastError (dwErrCode=0x0) [0175.054] GetLastError () returned 0x0 [0175.054] SetLastError (dwErrCode=0x0) [0175.054] GetLastError () returned 0x0 [0175.055] SetLastError (dwErrCode=0x0) [0175.055] GetLastError () returned 0x0 [0175.055] SetLastError (dwErrCode=0x0) [0175.055] GetLastError () returned 0x0 [0175.055] SetLastError (dwErrCode=0x0) [0175.055] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0175.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x38ef870, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37XpR", lpUsedDefaultChar=0x0) returned 5 [0175.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0175.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c30 [0175.055] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0175.056] WriteFile (in: hFile=0x508, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x38ef9b4*=0xe58, lpOverlapped=0x0) returned 1 [0175.057] CloseHandle (hObject=0x508) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4330 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321230 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0175.058] CryptDestroyKey (hKey=0x5260f48) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3d58 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365110 | out: hHeap=0x310000) returned 1 [0175.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6420 | out: hHeap=0x310000) returned 1 [0175.058] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0175.058] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0175.058] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.058] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0175.080] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.080] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0175.080] CloseHandle (hObject=0x508) returned 1 [0175.080] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0175.080] RmStartSession () returned 0x0 [0175.084] RmRegisterResources () returned 0x0 [0175.089] RmGetList () returned 0x0 [0180.631] RmShutdown () returned 0x0 [0182.839] RmEndSession () returned 0x0 [0183.004] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52611c8) returned 1 [0183.005] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0183.005] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0183.005] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0183.005] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0183.005] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=69632) returned 1 [0183.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0183.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6215020 [0183.021] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0183.021] ReadFile (in: hFile=0x508, lpBuffer=0x6215040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6215040*, lpNumberOfBytesRead=0x38efa40*=0x11000, lpOverlapped=0x0) returned 1 [0183.089] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0183.089] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.089] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.089] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.090] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.090] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.091] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0183.091] WriteFile (in: hFile=0x508, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0183.091] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0183.091] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0183.091] WriteFile (in: hFile=0x508, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0183.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6215020 | out: hHeap=0x310000) returned 1 [0183.097] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0183.097] CloseHandle (hObject=0x508) returned 1 [0183.099] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0183.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327c78 [0183.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0183.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5328138 [0183.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327c78 | out: hHeap=0x310000) returned 1 [0183.100] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0183.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0183.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0183.100] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0183.100] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.101] SetLastError (dwErrCode=0x0) [0183.101] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0183.102] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab6d8 [0183.102] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.102] GetLastError () returned 0x0 [0183.102] SetLastError (dwErrCode=0x0) [0183.103] GetLastError () returned 0x0 [0183.103] SetLastError (dwErrCode=0x0) [0183.103] GetLastError () returned 0x0 [0183.103] SetLastError (dwErrCode=0x0) [0183.103] GetLastError () returned 0x0 [0183.103] SetLastError (dwErrCode=0x0) [0183.103] GetLastError () returned 0x0 [0183.103] SetLastError (dwErrCode=0x0) [0183.103] GetLastError () returned 0x0 [0183.103] SetLastError (dwErrCode=0x0) [0183.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0183.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0183.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0183.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x38c3b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", lpUsedDefaultChar=0x0) returned 31 [0183.520] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab6d8 | out: hHeap=0x310000) returned 1 [0183.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0183.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5409c80 [0183.520] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0183.520] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0183.521] WriteFile (in: hFile=0x4d4, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x38ef9b4*=0xe72, lpOverlapped=0x0) returned 1 [0183.522] CloseHandle (hObject=0x4d4) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5328138 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0183.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0183.522] CryptDestroyKey (hKey=0x52611c8) returned 1 [0183.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0183.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea1d0 | out: hHeap=0x310000) returned 1 [0183.523] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6510 | out: hHeap=0x310000) returned 1 [0183.523] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0183.523] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0183.523] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.523] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0183.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.524] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0183.524] CloseHandle (hObject=0x4d4) returned 1 [0183.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3effa0 [0183.524] RmStartSession () returned 0x0 [0183.773] RmRegisterResources () returned 0x0 [0183.777] RmGetList () returned 0x0 [0185.366] RmShutdown () returned 0x0 [0188.261] RmEndSession () returned 0x0 [0188.262] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52618c8) returned 1 [0188.262] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0188.262] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0188.262] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0188.262] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0188.262] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=69632) returned 1 [0188.262] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5b520a0 [0188.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589d020 [0189.026] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0189.026] ReadFile (in: hFile=0x690, lpBuffer=0x589d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x589d040*, lpNumberOfBytesRead=0x38efa40*=0x11000, lpOverlapped=0x0) returned 1 [0189.028] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0189.028] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.028] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.028] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.028] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.028] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.028] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.028] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.028] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.028] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.028] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.029] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.029] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.029] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.029] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.029] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.029] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.029] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5b520c0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0189.029] WriteFile (in: hFile=0x690, lpBuffer=0x5b520c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5b520c0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0189.029] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0189.030] WriteFile (in: hFile=0x690, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0189.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589d020 | out: hHeap=0x310000) returned 1 [0190.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5b520a0 | out: hHeap=0x310000) returned 1 [0190.735] CloseHandle (hObject=0x690) returned 1 [0190.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0190.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327e40 [0190.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0540 [0190.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5328138 [0190.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327e40 | out: hHeap=0x310000) returned 1 [0190.737] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0630 [0190.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.737] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0190.737] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.738] SetLastError (dwErrCode=0x0) [0190.738] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b848 [0190.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bad438 [0190.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b848 | out: hHeap=0x310000) returned 1 [0190.739] GetLastError () returned 0x0 [0190.739] SetLastError (dwErrCode=0x0) [0190.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0190.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0190.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0190.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c1d8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0190.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad438 | out: hHeap=0x310000) returned 1 [0190.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0190.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540f3b0 [0190.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979a8 [0190.740] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0190.741] WriteFile (in: hFile=0x690, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe6c, lpOverlapped=0x0) returned 1 [0190.742] CloseHandle (hObject=0x690) returned 1 [0190.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979a8 | out: hHeap=0x310000) returned 1 [0190.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0190.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0630 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5328138 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0190.743] CryptDestroyKey (hKey=0x52618c8) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0190.743] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6e20 | out: hHeap=0x310000) returned 1 [0190.743] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0190.743] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0190.743] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.743] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0190.758] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.758] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0190.758] CloseHandle (hObject=0x690) returned 1 [0190.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0090 [0190.759] RmStartSession () returned 0x0 [0190.762] RmRegisterResources () returned 0x0 [0190.766] RmGetList () returned 0x0 [0191.269] RmShutdown () returned 0x0 [0193.288] RmEndSession () returned 0x0 [0193.289] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260f88) returned 1 [0193.289] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0193.289] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0193.289] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0193.290] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0193.290] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=69632) returned 1 [0193.290] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0193.290] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e2020 [0193.311] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0193.311] ReadFile (in: hFile=0x690, lpBuffer=0x49e2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x49e2040*, lpNumberOfBytesRead=0x38efa40*=0x11000, lpOverlapped=0x0) returned 1 [0193.352] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0193.352] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.352] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.353] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.353] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.354] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.354] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.354] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0193.354] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0193.354] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0193.354] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0193.354] WriteFile (in: hFile=0x690, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0193.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e2020 | out: hHeap=0x310000) returned 1 [0193.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0193.359] CloseHandle (hObject=0x690) returned 1 [0193.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0193.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532ad28 [0193.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0193.359] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532abf8 [0193.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532ad28 | out: hHeap=0x310000) returned 1 [0193.359] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.360] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0193.360] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0193.360] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0193.360] GetLastError () returned 0x0 [0193.360] SetLastError (dwErrCode=0x0) [0193.360] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0193.360] GetLastError () returned 0x0 [0193.360] SetLastError (dwErrCode=0x0) [0193.360] GetLastError () returned 0x0 [0193.360] SetLastError (dwErrCode=0x0) [0193.360] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0193.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0193.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x38ef870, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T", lpUsedDefaultChar=0x0) returned 1 [0193.361] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0193.361] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0193.361] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0193.361] WriteFile (in: hFile=0x690, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x38ef9b4*=0xe54, lpOverlapped=0x0) returned 1 [0193.362] CloseHandle (hObject=0x690) returned 1 [0193.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0193.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0193.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0193.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0193.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532abf8 | out: hHeap=0x310000) returned 1 [0193.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0193.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0193.363] CryptDestroyKey (hKey=0x5260f88) returned 1 [0193.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0090 | out: hHeap=0x310000) returned 1 [0193.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19a38 | out: hHeap=0x310000) returned 1 [0193.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44c18 | out: hHeap=0x310000) returned 1 [0193.363] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0193.363] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0193.363] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.363] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0193.774] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.774] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0193.775] CloseHandle (hObject=0x690) returned 1 [0193.777] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532ac90 [0193.777] RmStartSession () returned 0x0 [0194.019] RmRegisterResources () returned 0x0 [0194.023] RmGetList () returned 0x0 [0194.800] RmShutdown () returned 0x0 [0196.190] RmEndSession () returned 0x0 [0196.191] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260f08) returned 1 [0196.191] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0196.191] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash", dwFileAttributes=0x20) returned 1 [0196.191] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0196.191] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0196.191] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=102) returned 1 [0196.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0196.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589c020 [0196.586] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0196.586] ReadFile (in: hFile=0x690, lpBuffer=0x589c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x589c040*, lpNumberOfBytesRead=0x38efa40*=0x66, lpOverlapped=0x0) returned 1 [0196.587] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0196.587] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0196.587] WriteFile (in: hFile=0x690, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0196.589] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x690, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0196.589] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589c020 | out: hHeap=0x310000) returned 1 [0197.652] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0197.652] CloseHandle (hObject=0x690) returned 1 [0197.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0197.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b79dd0 [0197.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a86b0 [0197.652] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x51b9fd8 [0197.653] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b79dd0 | out: hHeap=0x310000) returned 1 [0197.653] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.bdcddcbaad"), dwFlags=0x1) returned 1 [0197.653] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a87e0 [0197.653] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc2b8 [0197.653] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0197.653] GetLastError () returned 0x0 [0197.653] SetLastError (dwErrCode=0x0) [0197.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc010 [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.654] GetLastError () returned 0x0 [0197.654] SetLastError (dwErrCode=0x0) [0197.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc010 | out: hHeap=0x310000) returned 1 [0197.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OpsjFeOClMNTu", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0197.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OpsjFeOClMNTu", cchWideChar=13, lpMultiByteStr=0x38ef870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpsjFeOClMNTu", lpUsedDefaultChar=0x0) returned 13 [0197.655] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0197.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0197.655] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b68b0 [0197.655] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0197.656] WriteFile (in: hFile=0x690, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe60, lpOverlapped=0x0) returned 1 [0197.656] CloseHandle (hObject=0x690) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b68b0 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc2b8 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a87e0 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b9fd8 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a86b0 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0197.660] CryptDestroyKey (hKey=0x5260f08) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532ac90 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c578 | out: hHeap=0x310000) returned 1 [0197.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b447b8 | out: hHeap=0x310000) returned 1 [0197.660] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0197.660] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0197.661] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.661] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0197.711] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.711] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0197.711] CloseHandle (hObject=0x690) returned 1 [0197.711] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6bf8 [0197.711] RmStartSession () returned 0x0 [0197.714] RmRegisterResources () returned 0x0 [0197.718] RmGetList () returned 0x0 [0199.684] RmShutdown () returned 0x0 [0201.701] RmEndSession () returned 0x0 [0201.702] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x35dc88) returned 1 [0201.703] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0201.703] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", dwFileAttributes=0x20) returned 0 [0201.703] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.703] CryptDestroyKey (hKey=0x35dc88) returned 1 [0201.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6bf8 | out: hHeap=0x310000) returned 1 [0201.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92f58 | out: hHeap=0x310000) returned 1 [0201.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07e20 | out: hHeap=0x310000) returned 1 [0201.703] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0201.703] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0201.704] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.704] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0201.722] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.722] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0201.722] CloseHandle (hObject=0x690) returned 1 [0201.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0201.722] RmStartSession () returned 0x0 [0201.724] RmRegisterResources () returned 0x0 [0201.724] RmGetList () returned 0x0 [0201.946] RmShutdown () returned 0x0 [0203.817] RmEndSession () returned 0x0 [0203.818] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x35d908) returned 1 [0203.818] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0203.818] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui", dwFileAttributes=0x20) returned 0 [0203.818] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.818] CryptDestroyKey (hKey=0x35d908) returned 1 [0203.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0203.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c928c8 | out: hHeap=0x310000) returned 1 [0203.818] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07bf0 | out: hHeap=0x310000) returned 1 [0203.818] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0203.819] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0203.819] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.819] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0203.866] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.866] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0203.867] CloseHandle (hObject=0x690) returned 1 [0203.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92778 [0203.867] RmStartSession () returned 0x0 [0203.869] RmRegisterResources () returned 0x0 [0203.870] RmGetList () returned 0x0 [0204.186] RmShutdown () returned 0x0 [0206.120] RmEndSession () returned 0x0 [0206.215] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261488) returned 1 [0206.215] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0206.215] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0206.215] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0206.215] CryptDestroyKey (hKey=0x5261488) returned 1 [0206.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92778 | out: hHeap=0x310000) returned 1 [0206.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93348 | out: hHeap=0x310000) returned 1 [0206.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08000 | out: hHeap=0x310000) returned 1 [0206.215] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0206.215] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0206.216] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.216] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0206.254] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.254] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0206.254] CloseHandle (hObject=0x690) returned 1 [0206.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92820 [0206.254] RmStartSession () returned 0x0 [0206.258] RmRegisterResources () returned 0x0 [0206.261] RmGetList () returned 0x0 [0206.433] RmShutdown () returned 0x0 [0207.414] RmEndSession () returned 0x0 [0207.415] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261788) returned 1 [0207.415] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0207.415] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", dwFileAttributes=0x20) returned 0 [0207.415] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.415] CryptDestroyKey (hKey=0x5261788) returned 1 [0207.415] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92820 | out: hHeap=0x310000) returned 1 [0207.415] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93dc8 | out: hHeap=0x310000) returned 1 [0207.415] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c084b0 | out: hHeap=0x310000) returned 1 [0207.415] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0207.415] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0207.415] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.416] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0207.436] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.436] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0207.436] CloseHandle (hObject=0x690) returned 1 [0207.436] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ebbb8 [0207.436] RmStartSession () returned 0x0 [0207.438] RmRegisterResources () returned 0x0 [0207.443] RmGetList () returned 0x0 [0207.768] RmShutdown () returned 0x0 [0209.851] RmEndSession () returned 0x0 [0210.233] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261148) returned 1 [0210.233] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0210.234] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", dwFileAttributes=0x20) returned 0 [0210.234] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.234] CryptDestroyKey (hKey=0x5261148) returned 1 [0210.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ebbb8 | out: hHeap=0x310000) returned 1 [0210.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc5a8 | out: hHeap=0x310000) returned 1 [0210.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08550 | out: hHeap=0x310000) returned 1 [0210.234] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0210.234] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0210.234] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.234] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0210.235] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.235] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0210.235] CloseHandle (hObject=0x690) returned 1 [0210.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92a18 [0210.235] RmStartSession () returned 0x0 [0210.250] RmRegisterResources () returned 0x0 [0210.254] RmGetList () returned 0x0 [0212.798] RmShutdown () returned 0x0 [0214.172] RmEndSession () returned 0x0 [0214.327] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260c08) returned 1 [0214.327] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0214.328] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", dwFileAttributes=0x20) returned 0 [0214.328] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.328] CryptDestroyKey (hKey=0x5260c08) returned 1 [0214.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92a18 | out: hHeap=0x310000) returned 1 [0214.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0214.328] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5420 | out: hHeap=0x310000) returned 1 [0214.328] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0214.328] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0214.328] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.328] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0214.357] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.357] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0214.357] CloseHandle (hObject=0x548) returned 1 [0214.357] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bcd40 [0214.357] RmStartSession () returned 0x0 [0214.674] RmRegisterResources () returned 0x0 [0214.775] RmGetList () returned 0x0 [0220.560] RmShutdown () returned 0x0 [0222.579] RmEndSession () returned 0x0 [0222.730] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261908) returned 1 [0222.730] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0222.730] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml", dwFileAttributes=0x20) returned 0 [0222.730] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.730] CryptDestroyKey (hKey=0x5261908) returned 1 [0222.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bcd40 | out: hHeap=0x310000) returned 1 [0222.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebb50 | out: hHeap=0x310000) returned 1 [0222.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6230 | out: hHeap=0x310000) returned 1 [0222.730] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0222.731] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0222.731] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.731] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0222.762] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.762] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0222.762] CloseHandle (hObject=0x564) returned 1 [0222.762] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92ac0 [0222.763] RmStartSession () returned 0x0 [0222.766] RmRegisterResources () returned 0x0 [0222.767] RmGetList () returned 0x0 [0223.134] RmShutdown () returned 0x0 [0224.372] RmEndSession () returned 0x0 [0224.373] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52617c8) returned 1 [0224.373] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0224.373] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0224.373] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.373] CryptDestroyKey (hKey=0x52617c8) returned 1 [0224.373] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92ac0 | out: hHeap=0x310000) returned 1 [0224.373] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee3f0 | out: hHeap=0x310000) returned 1 [0224.373] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c143d0 | out: hHeap=0x310000) returned 1 [0224.374] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0224.374] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0224.374] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.374] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0224.376] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.376] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0224.377] CloseHandle (hObject=0x564) returned 1 [0224.377] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3ef308 [0224.377] RmStartSession () returned 0x0 [0224.380] RmRegisterResources () returned 0x0 [0224.550] RmGetList () returned 0x0 [0224.807] RmShutdown () returned 0x0 [0226.701] RmEndSession () returned 0x0 [0226.701] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52617c8) returned 1 [0226.701] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0226.702] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0226.702] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.702] CryptDestroyKey (hKey=0x52617c8) returned 1 [0226.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef308 | out: hHeap=0x310000) returned 1 [0226.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eebd0 | out: hHeap=0x310000) returned 1 [0226.702] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14100 | out: hHeap=0x310000) returned 1 [0226.702] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0226.702] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0226.703] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.703] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0226.775] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.775] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0226.775] CloseHandle (hObject=0x564) returned 1 [0226.775] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0226.775] RmStartSession () returned 0x0 [0228.406] RmRegisterResources () returned 0x0 [0228.410] RmGetList () returned 0x0 [0230.606] RmShutdown () returned 0x0 [0231.721] RmEndSession () returned 0x0 [0232.151] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261708) returned 1 [0232.151] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0232.151] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", dwFileAttributes=0x20) returned 0 [0232.151] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.151] CryptDestroyKey (hKey=0x5261708) returned 1 [0232.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0232.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571348 | out: hHeap=0x310000) returned 1 [0232.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14b00 | out: hHeap=0x310000) returned 1 [0232.151] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0232.151] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0232.151] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.151] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0232.252] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.252] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0232.252] CloseHandle (hObject=0x564) returned 1 [0232.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0232.252] RmStartSession () returned 0x0 [0232.255] RmRegisterResources () returned 0x0 [0232.255] RmGetList () returned 0x0 [0232.608] RmShutdown () returned 0x0 [0234.069] RmEndSession () returned 0x0 [0234.070] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52612c8) returned 1 [0234.070] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0234.070] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", dwFileAttributes=0x20) returned 0 [0234.070] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.070] CryptDestroyKey (hKey=0x52612c8) returned 1 [0234.070] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0234.070] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571478 | out: hHeap=0x310000) returned 1 [0234.070] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55729c8 | out: hHeap=0x310000) returned 1 [0234.070] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0234.070] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0234.071] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.071] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0234.092] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.092] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0234.092] CloseHandle (hObject=0x564) returned 1 [0234.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0234.092] RmStartSession () returned 0x0 [0234.097] RmRegisterResources () returned 0x0 [0235.871] RmGetList () returned 0x0 [0236.526] RmShutdown () returned 0x0 [0237.687] RmEndSession () returned 0x0 [0237.875] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261648) returned 1 [0237.875] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0237.875] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui", dwFileAttributes=0x20) returned 0 [0237.876] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.876] CryptDestroyKey (hKey=0x5261648) returned 1 [0237.876] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0237.876] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a34d8 | out: hHeap=0x310000) returned 1 [0237.876] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572248 | out: hHeap=0x310000) returned 1 [0237.876] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0237.876] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0237.877] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.877] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0238.007] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.007] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0238.007] CloseHandle (hObject=0x564) returned 1 [0238.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0238.007] RmStartSession () returned 0x0 [0238.010] RmRegisterResources () returned 0x0 [0238.010] RmGetList () returned 0x0 [0238.302] RmShutdown () returned 0x0 [0240.499] RmEndSession () returned 0x0 [0240.500] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260c08) returned 1 [0240.500] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0240.500] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", dwFileAttributes=0x20) returned 1 [0240.501] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0240.501] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0240.501] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=14156) returned 1 [0240.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5cf70 [0240.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64ba020 [0241.048] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0241.048] ReadFile (in: hFile=0x564, lpBuffer=0x64ba040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x64ba040*, lpNumberOfBytesRead=0x38efa40*=0x374c, lpOverlapped=0x0) returned 1 [0241.051] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0241.051] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0241.051] WriteFile (in: hFile=0x564, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0241.051] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0241.051] WriteFile (in: hFile=0x564, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0241.051] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0241.051] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0241.052] WriteFile (in: hFile=0x564, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0241.052] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64ba020 | out: hHeap=0x310000) returned 1 [0242.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5cf70 | out: hHeap=0x310000) returned 1 [0242.003] CloseHandle (hObject=0x564) returned 1 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0243.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0243.726] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.bdcddcbaad"), dwFlags=0x1) returned 1 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0243.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0243.726] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] GetLastError () returned 0x0 [0243.727] SetLastError (dwErrCode=0x0) [0243.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0243.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x38ef870, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dbs6NV", lpUsedDefaultChar=0x0) returned 6 [0243.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0243.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0243.727] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0243.728] WriteFile (in: hFile=0x630, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x38ef9b4*=0xe59, lpOverlapped=0x0) returned 1 [0243.729] CloseHandle (hObject=0x630) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0243.729] CryptDestroyKey (hKey=0x5260c08) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3010 | out: hHeap=0x310000) returned 1 [0243.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572428 | out: hHeap=0x310000) returned 1 [0243.729] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0243.729] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0243.729] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.730] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0243.732] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.732] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0243.732] CloseHandle (hObject=0x630) returned 1 [0243.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0243.732] RmStartSession () returned 0x0 [0243.734] RmRegisterResources () returned 0x0 [0243.735] RmGetList () returned 0x0 [0244.328] RmShutdown () returned 0x0 [0244.804] RmEndSession () returned 0x0 [0244.805] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260c08) returned 1 [0244.805] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0244.805] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar", dwFileAttributes=0x20) returned 1 [0244.805] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0244.805] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0244.805] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=68924) returned 1 [0244.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0244.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7800020 [0245.314] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0245.314] GetLastError () returned 0x0 [0245.314] SetLastError (dwErrCode=0x0) [0245.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0245.314] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0245.315] GetLastError () returned 0x0 [0245.315] SetLastError (dwErrCode=0x0) [0245.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0245.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0245.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x38ef870, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0245.315] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0245.315] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0245.315] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0245.315] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0245.317] WriteFile (in: hFile=0x630, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe5c, lpOverlapped=0x0) returned 1 [0245.317] CloseHandle (hObject=0x630) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d08 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0245.318] CryptDestroyKey (hKey=0x5260c08) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a0c0 | out: hHeap=0x310000) returned 1 [0245.318] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352740 | out: hHeap=0x310000) returned 1 [0245.318] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0245.318] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0245.318] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.318] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0245.320] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.321] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0245.321] CloseHandle (hObject=0x630) returned 1 [0245.321] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0245.321] RmStartSession () returned 0x0 [0245.323] RmRegisterResources () returned 0x0 [0245.327] RmGetList () returned 0x0 [0245.985] RmShutdown () returned 0x0 [0247.596] RmEndSession () returned 0x0 [0247.596] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261248) returned 1 [0247.596] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0247.597] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf", dwFileAttributes=0x20) returned 1 [0247.597] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0247.597] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0247.597] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=80856) returned 1 [0247.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0247.597] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d5020 [0251.812] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0251.812] GetLastError () returned 0x0 [0251.812] SetLastError (dwErrCode=0x0) [0251.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0251.812] GetLastError () returned 0x0 [0251.812] SetLastError (dwErrCode=0x0) [0251.812] GetLastError () returned 0x0 [0251.812] SetLastError (dwErrCode=0x0) [0251.812] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0251.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0251.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x38ef870, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y", lpUsedDefaultChar=0x0) returned 1 [0251.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0251.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0251.812] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0251.813] WriteFile (in: hFile=0x630, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe54, lpOverlapped=0x0) returned 1 [0251.814] CloseHandle (hObject=0x630) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391e50 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0251.814] CryptDestroyKey (hKey=0x5261248) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570638 | out: hHeap=0x310000) returned 1 [0251.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352a60 | out: hHeap=0x310000) returned 1 [0251.814] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0251.814] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0251.815] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.815] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0251.838] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.838] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0251.838] CloseHandle (hObject=0x630) returned 1 [0251.839] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0251.839] RmStartSession () returned 0x0 [0252.100] RmRegisterResources () returned 0x0 [0252.104] RmGetList () returned 0x0 [0252.188] RmShutdown () returned 0x0 [0252.506] RmEndSession () returned 0x0 [0252.507] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260e08) returned 1 [0252.507] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0252.507] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist", dwFileAttributes=0x20) returned 1 [0252.507] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0252.507] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0252.507] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=4054) returned 1 [0252.507] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0252.508] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c8020 [0252.526] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0252.526] ReadFile (in: hFile=0x630, lpBuffer=0x65c8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x65c8040*, lpNumberOfBytesRead=0x38efa40*=0xfd6, lpOverlapped=0x0) returned 1 [0252.528] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0252.528] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0252.528] WriteFile (in: hFile=0x630, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0252.528] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0252.528] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0252.528] WriteFile (in: hFile=0x630, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0252.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c8020 | out: hHeap=0x310000) returned 1 [0252.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d6a020 | out: hHeap=0x310000) returned 1 [0252.533] CloseHandle (hObject=0x630) returned 1 [0252.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0252.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0252.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0252.533] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0252.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0252.533] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.bdcddcbaad"), dwFlags=0x1) returned 1 [0252.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0252.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d198d0 [0252.534] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0252.534] GetLastError () returned 0x0 [0252.534] SetLastError (dwErrCode=0x0) [0252.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0252.534] GetLastError () returned 0x0 [0252.534] SetLastError (dwErrCode=0x0) [0252.534] GetLastError () returned 0x0 [0252.534] SetLastError (dwErrCode=0x0) [0252.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0252.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0252.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x38ef870, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y", lpUsedDefaultChar=0x0) returned 1 [0252.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0252.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0252.535] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0252.535] WriteFile (in: hFile=0x630, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe54, lpOverlapped=0x0) returned 1 [0252.536] CloseHandle (hObject=0x630) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0252.536] CryptDestroyKey (hKey=0x5260e08) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3340 | out: hHeap=0x310000) returned 1 [0252.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352d80 | out: hHeap=0x310000) returned 1 [0252.536] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0252.536] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0252.537] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.537] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0252.544] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.544] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0252.544] CloseHandle (hObject=0x630) returned 1 [0252.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0252.544] RmStartSession () returned 0x0 [0252.545] RmRegisterResources () returned 0x0 [0252.546] RmGetList () returned 0x0 [0253.147] RmShutdown () returned 0x0 [0254.359] RmEndSession () returned 0x0 [0254.360] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261208) returned 1 [0254.360] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0254.360] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs", dwFileAttributes=0x20) returned 1 [0254.360] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0254.361] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0254.361] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=1253) returned 1 [0254.361] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5f14028 [0254.361] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58ab020 [0254.574] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0254.574] ReadFile (in: hFile=0x630, lpBuffer=0x58ab040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x58ab040*, lpNumberOfBytesRead=0x38efa40*=0x4e5, lpOverlapped=0x0) returned 1 [0254.575] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0254.575] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5f14040*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5f14040*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0254.576] WriteFile (in: hFile=0x630, lpBuffer=0x5f14040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5f14040*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0254.576] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0254.576] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0254.576] WriteFile (in: hFile=0x630, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0254.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58ab020 | out: hHeap=0x310000) returned 1 [0254.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f14028 | out: hHeap=0x310000) returned 1 [0254.616] CloseHandle (hObject=0x630) returned 1 [0254.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0254.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0254.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0254.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0254.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0254.616] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.bdcddcbaad"), dwFlags=0x1) returned 1 [0254.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0254.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a230 [0254.617] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] GetLastError () returned 0x0 [0254.617] SetLastError (dwErrCode=0x0) [0254.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0254.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BovCg0H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BovCg0H", cchWideChar=7, lpMultiByteStr=0x38ef870, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BovCg0H", lpUsedDefaultChar=0x0) returned 7 [0254.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0254.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0254.618] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0254.618] WriteFile (in: hFile=0x630, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x38ef9b4*=0xe5a, lpOverlapped=0x0) returned 1 [0254.619] CloseHandle (hObject=0x630) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0254.619] CryptDestroyKey (hKey=0x5261208) returned 1 [0254.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0254.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x556fe80 | out: hHeap=0x310000) returned 1 [0254.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53530a0 | out: hHeap=0x310000) returned 1 [0254.620] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0254.620] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0254.620] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.620] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0254.785] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.785] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0254.785] CloseHandle (hObject=0x630) returned 1 [0254.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0254.786] RmStartSession () returned 0x0 [0254.787] RmRegisterResources () returned 0x0 [0254.787] RmGetList () returned 0x0 [0254.829] RmShutdown () returned 0x0 [0258.350] RmEndSession () returned 0x0 [0258.351] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261a08) returned 1 [0258.351] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0258.351] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar", dwFileAttributes=0x20) returned 1 [0258.352] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0258.352] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0258.352] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=3026) returned 1 [0258.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0258.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d1020 [0260.200] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] GetLastError () returned 0x0 [0260.200] SetLastError (dwErrCode=0x0) [0260.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0260.201] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.201] SetLastError (dwErrCode=0x0) [0260.201] GetLastError () returned 0x0 [0260.202] SetLastError (dwErrCode=0x0) [0260.202] GetLastError () returned 0x0 [0260.202] SetLastError (dwErrCode=0x0) [0260.202] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x61120b0 [0260.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0260.202] GetLastError () returned 0x0 [0260.202] SetLastError (dwErrCode=0x0) [0260.202] GetLastError () returned 0x0 [0260.202] SetLastError (dwErrCode=0x0) [0260.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0260.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0260.202] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0260.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", cchWideChar=26, lpMultiByteStr=0x38c160, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K3ZMhCzaia8Eb3co5M7vQgRKFp", lpUsedDefaultChar=0x0) returned 26 [0260.202] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61120b0 | out: hHeap=0x310000) returned 1 [0260.202] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0260.203] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0260.203] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0260.203] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0260.204] WriteFile (in: hFile=0x630, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe6d, lpOverlapped=0x0) returned 1 [0260.204] CloseHandle (hObject=0x630) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc718 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0260.205] CryptDestroyKey (hKey=0x5261a08) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570a60 | out: hHeap=0x310000) returned 1 [0260.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53535a0 | out: hHeap=0x310000) returned 1 [0260.205] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0260.205] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0260.206] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.206] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0260.291] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.291] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0260.291] CloseHandle (hObject=0x630) returned 1 [0260.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f059b0 [0260.292] RmStartSession () returned 0x0 [0260.294] RmRegisterResources () returned 0x0 [0260.298] RmGetList () returned 0x0 [0261.940] RmShutdown () returned 0x0 [0264.911] RmEndSession () returned 0x0 [0264.912] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261608) returned 1 [0264.913] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0264.913] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.913] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0264.913] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0264.913] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=1261) returned 1 [0264.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8f370 [0264.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3b020 [0265.715] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.716] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0265.716] GetLastError () returned 0x0 [0265.716] SetLastError (dwErrCode=0x0) [0265.717] GetLastError () returned 0x0 [0265.717] SetLastError (dwErrCode=0x0) [0265.717] GetLastError () returned 0x0 [0265.717] SetLastError (dwErrCode=0x0) [0265.717] GetLastError () returned 0x0 [0265.717] SetLastError (dwErrCode=0x0) [0265.717] GetLastError () returned 0x0 [0265.717] SetLastError (dwErrCode=0x0) [0265.717] GetLastError () returned 0x0 [0265.717] SetLastError (dwErrCode=0x0) [0265.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0265.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0265.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x38ef870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0265.717] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0265.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0265.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0265.717] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0265.717] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0265.718] WriteFile (in: hFile=0x630, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x38ef9b4*=0xe61, lpOverlapped=0x0) returned 1 [0265.719] CloseHandle (hObject=0x630) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04138 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5398e88 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04c18 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0265.719] CryptDestroyKey (hKey=0x5261608) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f059b0 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9718 | out: hHeap=0x310000) returned 1 [0265.719] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351b10 | out: hHeap=0x310000) returned 1 [0265.719] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0265.719] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0265.719] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.719] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0265.730] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.730] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0265.731] CloseHandle (hObject=0x630) returned 1 [0265.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0ab40 [0265.731] RmStartSession () returned 0x0 [0265.841] RmRegisterResources () returned 0x0 [0265.842] RmGetList () returned 0x0 [0265.919] RmShutdown () returned 0x0 [0267.107] RmEndSession () returned 0x0 [0267.108] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52613c8) returned 1 [0267.108] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0267.108] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0267.108] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0267.108] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0267.108] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=1261) returned 1 [0267.109] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0268.111] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0268.111] GetLastError () returned 0x0 [0268.111] SetLastError (dwErrCode=0x0) [0268.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.112] GetLastError () returned 0x0 [0268.112] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0268.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] SetLastError (dwErrCode=0x0) [0268.113] GetLastError () returned 0x0 [0268.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0268.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0268.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x38c3b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3PiqIn2wVpHXSiax4SL", lpUsedDefaultChar=0x0) returned 20 [0268.113] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0268.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0268.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0268.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0268.114] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0268.114] WriteFile (in: hFile=0x650, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x38ef9b4*=0xe67, lpOverlapped=0x0) returned 1 [0268.115] CloseHandle (hObject=0x650) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b9f838 | out: hHeap=0x310000) returned 1 [0268.115] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f440 | out: hHeap=0x310000) returned 1 [0268.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0268.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0268.116] CryptDestroyKey (hKey=0x52613c8) returned 1 [0268.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0ab40 | out: hHeap=0x310000) returned 1 [0268.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53492b8 | out: hHeap=0x310000) returned 1 [0268.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c192e0 | out: hHeap=0x310000) returned 1 [0268.116] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0268.116] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0268.116] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.116] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0268.118] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.118] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0268.118] CloseHandle (hObject=0x650) returned 1 [0268.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0268.118] RmStartSession () returned 0x0 [0268.120] RmRegisterResources () returned 0x0 [0268.120] RmGetList () returned 0x0 [0269.167] RmShutdown () returned 0x0 [0270.208] RmEndSession () returned 0x0 [0270.209] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52613c8) returned 1 [0270.209] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0270.209] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF", dwFileAttributes=0x220) returned 1 [0270.209] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0270.210] CryptEncrypt (in: hKey=0x52613c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0270.210] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=12702) returned 1 [0270.210] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0270.210] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bd020 [0270.432] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0270.432] GetLastError () returned 0x0 [0270.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0270.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0270.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c3b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0270.433] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89eb0 | out: hHeap=0x310000) returned 1 [0270.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0270.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0270.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0270.433] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0270.434] WriteFile (in: hFile=0x650, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x38ef9b4*=0xe6e, lpOverlapped=0x0) returned 1 [0270.435] CloseHandle (hObject=0x650) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dce48 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0270.435] CryptDestroyKey (hKey=0x52613c8) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0270.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3040 | out: hHeap=0x310000) returned 1 [0270.435] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0270.435] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0270.435] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.436] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0270.452] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.452] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0270.452] CloseHandle (hObject=0x650) returned 1 [0270.452] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0270.452] RmStartSession () returned 0x0 [0270.454] RmRegisterResources () returned 0x0 [0270.458] RmGetList () returned 0x0 [0272.196] RmShutdown () returned 0x0 [0276.212] RmEndSession () returned 0x0 [0276.214] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x52617c8) returned 1 [0276.214] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0276.214] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF", dwFileAttributes=0x220) returned 1 [0276.214] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0276.214] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0276.214] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=7583) returned 1 [0276.214] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0277.781] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0277.781] GetLastError () returned 0x0 [0277.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0277.781] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0277.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c548, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0277.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0277.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0277.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0277.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.782] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0277.783] WriteFile (in: hFile=0x650, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x38ef9b4*=0xe68, lpOverlapped=0x0) returned 1 [0277.783] CloseHandle (hObject=0x650) returned 1 [0277.783] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0277.784] CryptDestroyKey (hKey=0x52617c8) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4e48 | out: hHeap=0x310000) returned 1 [0277.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2dc0 | out: hHeap=0x310000) returned 1 [0277.784] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0277.784] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0277.784] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.784] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0277.809] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.809] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0277.809] CloseHandle (hObject=0x650) returned 1 [0277.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0277.809] RmStartSession () returned 0x0 [0277.812] RmRegisterResources () returned 0x0 [0277.813] RmGetList () returned 0x0 [0277.854] RmShutdown () returned 0x0 [0277.889] RmEndSession () returned 0x0 [0277.890] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261a48) returned 1 [0277.890] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0277.890] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF", dwFileAttributes=0x220) returned 1 [0277.890] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0277.891] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0277.891] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=2344) returned 1 [0277.891] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0277.891] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7afd020 [0278.220] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0278.220] ReadFile (in: hFile=0x650, lpBuffer=0x7afd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x7afd040*, lpNumberOfBytesRead=0x38efa40*=0x928, lpOverlapped=0x0) returned 1 [0278.220] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0278.220] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d60020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d60020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0278.220] WriteFile (in: hFile=0x650, lpBuffer=0x5d60020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5d60020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0278.220] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0278.220] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0278.221] WriteFile (in: hFile=0x650, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0278.221] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7afd020 | out: hHeap=0x310000) returned 1 [0278.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d60010 | out: hHeap=0x310000) returned 1 [0278.625] CloseHandle (hObject=0x650) returned 1 [0278.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0278.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0278.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0278.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0278.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0278.626] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0278.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0278.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0278.627] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0278.627] GetLastError () returned 0x0 [0278.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0278.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c0c0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0278.628] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0278.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0278.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0278.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0278.628] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0278.629] WriteFile (in: hFile=0x650, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe68, lpOverlapped=0x0) returned 1 [0278.630] CloseHandle (hObject=0x650) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0278.630] CryptDestroyKey (hKey=0x5261a48) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6310 | out: hHeap=0x310000) returned 1 [0278.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1a10 | out: hHeap=0x310000) returned 1 [0278.630] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0278.630] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0278.631] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.631] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0278.632] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.632] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0278.632] CloseHandle (hObject=0x650) returned 1 [0278.633] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0278.633] RmStartSession () returned 0x0 [0278.635] RmRegisterResources () returned 0x0 [0278.636] RmGetList () returned 0x0 [0280.845] RmShutdown () returned 0x0 [0284.301] RmEndSession () returned 0x0 [0284.302] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261548) returned 1 [0284.302] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0284.302] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF", dwFileAttributes=0x220) returned 1 [0284.302] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0284.302] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0284.302] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=2636) returned 1 [0284.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0284.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6212020 [0285.054] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0285.054] ReadFile (in: hFile=0x650, lpBuffer=0x6212040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6212040*, lpNumberOfBytesRead=0x38efa40*=0xa4c, lpOverlapped=0x0) returned 1 [0285.055] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0285.055] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0285.055] WriteFile (in: hFile=0x650, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0285.055] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0285.056] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0285.056] WriteFile (in: hFile=0x650, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0285.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6212020 | out: hHeap=0x310000) returned 1 [0286.404] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0286.404] CloseHandle (hObject=0x650) returned 1 [0286.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0286.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c28e0 [0286.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0286.404] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2600 [0286.404] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c28e0 | out: hHeap=0x310000) returned 1 [0286.404] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0286.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4d18 [0286.405] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0286.405] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0286.405] GetLastError () returned 0x0 [0286.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0286.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aGphKsS54ZcVf9i", cchWideChar=15, lpMultiByteStr=0x38ef870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aGphKsS54ZcVf9i", lpUsedDefaultChar=0x0) returned 15 [0286.406] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0286.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0286.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0286.406] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157c48 [0286.406] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0286.407] WriteFile (in: hFile=0x650, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe62, lpOverlapped=0x0) returned 1 [0286.408] CloseHandle (hObject=0x650) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157c48 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4d18 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2600 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0286.408] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0286.409] CryptDestroyKey (hKey=0x5261548) returned 1 [0286.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0286.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6148 | out: hHeap=0x310000) returned 1 [0286.409] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e18d0 | out: hHeap=0x310000) returned 1 [0286.409] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0286.409] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0286.409] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.409] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0286.514] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.514] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0286.514] CloseHandle (hObject=0x650) returned 1 [0286.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0286.514] RmStartSession () returned 0x0 [0286.515] RmRegisterResources () returned 0x0 [0286.515] RmGetList () returned 0x0 [0287.115] RmShutdown () returned 0x0 [0287.564] RmEndSession () returned 0x0 [0287.565] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261848) returned 1 [0287.565] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0287.565] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF", dwFileAttributes=0x220) returned 1 [0287.565] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0287.565] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0287.565] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=20454) returned 1 [0287.565] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0287.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bf020 [0287.962] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0287.962] ReadFile (in: hFile=0x650, lpBuffer=0x64bf040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x64bf040*, lpNumberOfBytesRead=0x38efa40*=0x4fe6, lpOverlapped=0x0) returned 1 [0287.966] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0287.966] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0287.966] WriteFile (in: hFile=0x650, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0287.966] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0287.966] WriteFile (in: hFile=0x650, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0287.966] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0287.966] WriteFile (in: hFile=0x650, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0287.966] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0287.966] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0287.967] WriteFile (in: hFile=0x650, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0287.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64bf020 | out: hHeap=0x310000) returned 1 [0288.099] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0288.099] CloseHandle (hObject=0x650) returned 1 [0288.099] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0288.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c49f0 [0288.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0288.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c38b0 [0288.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c49f0 | out: hHeap=0x310000) returned 1 [0288.100] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0288.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0288.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0288.101] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0288.101] GetLastError () returned 0x0 [0288.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0288.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0288.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n02uzHYCkn2cuVUIt7q96r", cchWideChar=22, lpMultiByteStr=0x38c188, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n02uzHYCkn2cuVUIt7q96r", lpUsedDefaultChar=0x0) returned 22 [0288.101] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0288.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0288.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0288.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0288.101] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0288.102] WriteFile (in: hFile=0x650, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe69, lpOverlapped=0x0) returned 1 [0288.103] CloseHandle (hObject=0x650) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c38b0 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0288.103] CryptDestroyKey (hKey=0x5261848) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c953e0 | out: hHeap=0x310000) returned 1 [0288.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2370 | out: hHeap=0x310000) returned 1 [0288.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0288.104] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0288.104] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.104] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0288.165] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0288.165] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0288.165] CloseHandle (hObject=0x650) returned 1 [0288.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0288.166] RmStartSession () returned 0x0 [0288.167] RmRegisterResources () returned 0x0 [0288.167] RmGetList () returned 0x0 [0288.195] RmShutdown () returned 0x0 [0288.517] RmEndSession () returned 0x0 [0288.599] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261308) returned 1 [0288.599] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0288.599] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF", dwFileAttributes=0x220) returned 1 [0288.599] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0288.599] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0288.599] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=14486) returned 1 [0288.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0288.600] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b2020 [0289.177] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0289.177] ReadFile (in: hFile=0x650, lpBuffer=0x64b2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x64b2040*, lpNumberOfBytesRead=0x38efa40*=0x3896, lpOverlapped=0x0) returned 1 [0289.178] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0289.178] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0289.178] WriteFile (in: hFile=0x650, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0289.178] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0289.178] WriteFile (in: hFile=0x650, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0289.179] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0289.179] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0289.179] WriteFile (in: hFile=0x650, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0289.179] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b2020 | out: hHeap=0x310000) returned 1 [0289.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0289.958] CloseHandle (hObject=0x650) returned 1 [0289.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0289.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c38b0 [0289.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4be8 [0289.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4208 [0289.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c38b0 | out: hHeap=0x310000) returned 1 [0289.959] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a58f8 [0289.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.960] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0289.960] GetLastError () returned 0x0 [0289.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0289.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0289.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c548, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0289.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e0a0 | out: hHeap=0x310000) returned 1 [0289.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0289.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0289.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.961] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0289.961] WriteFile (in: hFile=0x650, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x38ef9b4*=0xe6f, lpOverlapped=0x0) returned 1 [0289.962] CloseHandle (hObject=0x650) returned 1 [0289.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4208 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4be8 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0289.963] CryptDestroyKey (hKey=0x5261308) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95a68 | out: hHeap=0x310000) returned 1 [0289.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2410 | out: hHeap=0x310000) returned 1 [0289.963] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0289.963] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0289.963] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.963] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0289.965] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.965] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0289.965] CloseHandle (hObject=0x650) returned 1 [0289.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a53a0 [0289.965] RmStartSession () returned 0x0 [0290.359] RmRegisterResources () returned 0x0 [0290.359] RmGetList () returned 0x0 [0291.680] RmShutdown () returned 0x0 [0292.483] RmEndSession () returned 0x0 [0292.723] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x35d6c8) returned 1 [0292.723] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0292.723] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF", dwFileAttributes=0x220) returned 1 [0292.724] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0292.724] CryptEncrypt (in: hKey=0x35d6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0292.724] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=10146) returned 1 [0292.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0292.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49fd020 [0292.852] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0292.852] ReadFile (in: hFile=0x574, lpBuffer=0x49fd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x49fd040*, lpNumberOfBytesRead=0x38efa40*=0x27a2, lpOverlapped=0x0) returned 1 [0292.875] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0292.875] CryptEncrypt (in: hKey=0x35d6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0292.875] WriteFile (in: hFile=0x574, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0292.875] CryptEncrypt (in: hKey=0x35d6c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0292.876] WriteFile (in: hFile=0x574, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0292.876] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0292.876] WriteFile (in: hFile=0x574, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0292.876] WriteFile (in: hFile=0x574, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0292.876] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49fd020 | out: hHeap=0x310000) returned 1 [0292.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0292.881] CloseHandle (hObject=0x574) returned 1 [0292.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0292.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4ef8 [0292.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4f78 [0292.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c60f0 [0292.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4ef8 | out: hHeap=0x310000) returned 1 [0292.882] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0292.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0292.892] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0292.892] GetLastError () returned 0x0 [0292.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0292.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x38ef870, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0292.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0292.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.893] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0292.894] WriteFile (in: hFile=0x574, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe59, lpOverlapped=0x0) returned 1 [0292.895] CloseHandle (hObject=0x574) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c60f0 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4f78 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0292.895] CryptDestroyKey (hKey=0x35d6c8) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a53a0 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95df8 | out: hHeap=0x310000) returned 1 [0292.895] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609a98 | out: hHeap=0x310000) returned 1 [0292.895] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0292.895] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x574 [0292.895] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.895] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0292.988] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.989] ReadFile (in: hFile=0x574, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0292.989] CloseHandle (hObject=0x574) returned 1 [0292.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5ac0 [0292.989] RmStartSession () returned 0x0 [0293.607] RmRegisterResources () returned 0x0 [0293.607] RmGetList () returned 0x0 [0293.966] RmShutdown () returned 0x0 [0294.669] RmEndSession () returned 0x0 [0294.670] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5260cc8) returned 1 [0294.670] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0294.670] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF", dwFileAttributes=0x220) returned 1 [0294.671] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0294.671] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0294.671] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=812) returned 1 [0294.671] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0294.672] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621e020 [0295.123] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0295.123] ReadFile (in: hFile=0x564, lpBuffer=0x621e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x621e040*, lpNumberOfBytesRead=0x38efa40*=0x32c, lpOverlapped=0x0) returned 1 [0295.123] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0295.123] CryptEncrypt (in: hKey=0x5260cc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0295.123] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0295.124] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0295.124] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0295.124] WriteFile (in: hFile=0x564, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0295.124] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621e020 | out: hHeap=0x310000) returned 1 [0295.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0295.302] CloseHandle (hObject=0x564) returned 1 [0295.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0295.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bfe78 [0295.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95b98 [0295.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf8b8 [0295.302] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bfe78 | out: hHeap=0x310000) returned 1 [0295.302] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0295.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95d60 [0295.303] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0295.303] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0295.303] GetLastError () returned 0x0 [0295.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0295.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x38ef870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrHQog3L8507y", lpUsedDefaultChar=0x0) returned 13 [0295.304] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0295.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0295.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0295.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0295.304] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0295.305] WriteFile (in: hFile=0x564, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x38ef9b4*=0xe60, lpOverlapped=0x0) returned 1 [0295.310] CloseHandle (hObject=0x564) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95d60 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf8b8 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b98 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0295.310] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5ac0 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306878 | out: hHeap=0x310000) returned 1 [0295.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a3a8 | out: hHeap=0x310000) returned 1 [0295.310] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0295.310] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0295.311] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.311] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0295.344] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.344] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0295.344] CloseHandle (hObject=0x564) returned 1 [0295.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95b98 [0295.344] RmStartSession () returned 0x0 [0295.345] RmRegisterResources () returned 0x0 [0295.347] RmGetList () returned 0x0 [0296.254] RmShutdown () returned 0x0 [0298.233] RmEndSession () returned 0x0 [0298.233] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x38efb40 | out: phKey=0x38efb40*=0x5261908) returned 1 [0298.234] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0298.234] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF", dwFileAttributes=0x220) returned 1 [0298.234] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0298.234] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x38ef9a0*=0x2000) returned 1 [0298.234] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38efa38 | out: lpFileSize=0x38efa38*=19476) returned 1 [0298.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0298.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6210020 [0298.543] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0298.543] ReadFile (in: hFile=0x564, lpBuffer=0x6210040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38efa40, lpOverlapped=0x0 | out: lpBuffer=0x6210040*, lpNumberOfBytesRead=0x38efa40*=0x4c14, lpOverlapped=0x0) returned 1 [0298.548] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa28 | out: lpNewFilePointer=0x0) returned 1 [0298.548] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0298.548] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0298.548] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0298.548] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0298.548] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x38ef9b4*=0x2000) returned 1 [0298.548] WriteFile (in: hFile=0x564, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x38efa44*=0x2000, lpOverlapped=0x0) returned 1 [0298.549] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efa30 | out: lpNewFilePointer=0x0) returned 1 [0298.549] WriteFile (in: hFile=0x564, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x38efa44*=0x200, lpOverlapped=0x0) returned 1 [0298.549] WriteFile (in: hFile=0x564, lpBuffer=0x38ef9e0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x38ef9e0*, lpNumberOfBytesWritten=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0298.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6210020 | out: hHeap=0x310000) returned 1 [0298.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0298.620] CloseHandle (hObject=0x564) returned 1 [0298.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0298.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606c068 [0298.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95c30 [0298.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606bfb0 [0298.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606c068 | out: hHeap=0x310000) returned 1 [0298.621] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0298.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c953e0 [0298.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0298.622] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x38ef814 | out: lpSystemTimeAsFileTime=0x38ef814) [0298.622] GetLastError () returned 0x0 [0298.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rkb0olPmAw8J5Hrd7OWIRX", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0298.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0298.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rkb0olPmAw8J5Hrd7OWIRX", cchWideChar=22, lpMultiByteStr=0x38c3e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rkb0olPmAw8J5Hrd7OWIRX", lpUsedDefaultChar=0x0) returned 22 [0298.623] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0298.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0298.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0298.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0298.623] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0298.624] WriteFile (in: hFile=0x564, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x38ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x38ef9b4*=0xe69, lpOverlapped=0x0) returned 1 [0298.625] CloseHandle (hObject=0x564) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c953e0 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606bfb0 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95c30 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0298.625] CryptDestroyKey (hKey=0x5261908) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b98 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5305a38 | out: hHeap=0x310000) returned 1 [0298.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609cc8 | out: hHeap=0x310000) returned 1 [0298.625] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x38efb74, lpCompletionKey=0x38efb78, lpOverlapped=0x38efb70) returned 1 [0298.625] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0298.626] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa48 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.626] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa44*=0x18, lpOverlapped=0x0) returned 1 [0298.690] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efa50 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.691] ReadFile (in: hFile=0x564, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x38efa38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x38efa38*=0x18, lpOverlapped=0x0) returned 1 [0298.691] CloseHandle (hObject=0x564) returned 1 [0298.691] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95b98 [0298.691] RmStartSession () returned 0x0 [0298.692] RmRegisterResources () returned 0x0 [0298.697] RmGetList () returned 0x0 [0299.507] RmShutdown () Thread: id = 14 os_tid = 0x10d4 [0068.624] GetLastError () returned 0x57 [0068.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x354be0 [0068.625] SetLastError (dwErrCode=0x57) [0068.625] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0080.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0098.980] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0100.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0108.721] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0127.651] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0135.604] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0135.606] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.606] ReadFile (in: hFile=0x5bc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0135.622] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.623] ReadFile (in: hFile=0x5bc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0135.623] CloseHandle (hObject=0x5bc) returned 1 [0135.623] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0135.623] RmStartSession () returned 0x0 [0137.029] RmRegisterResources () returned 0x0 [0137.033] RmGetList () returned 0x0 [0138.934] RmShutdown () returned 0x0 [0141.997] RmEndSession () returned 0x0 [0142.000] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261788) returned 1 [0142.000] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0142.000] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x80) returned 1 [0142.000] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0142.000] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0142.000] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=3726) returned 1 [0142.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0142.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x63b4020 [0142.451] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0142.451] ReadFile (in: hFile=0x5f4, lpBuffer=0x63b4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x63b4040*, lpNumberOfBytesRead=0x3a2f678*=0xe8e, lpOverlapped=0x0) returned 1 [0142.456] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0142.456] CryptEncrypt (in: hKey=0x5261788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0142.456] WriteFile (in: hFile=0x5f4, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0142.457] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0142.457] WriteFile (in: hFile=0x5f4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0142.457] WriteFile (in: hFile=0x5f4, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0142.457] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x63b4020 | out: hHeap=0x310000) returned 1 [0142.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0142.531] CloseHandle (hObject=0x5f4) returned 1 [0142.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0142.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0142.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e54c8 [0142.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0142.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0142.535] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1029\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0142.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0142.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0142.574] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.575] GetLastError () returned 0x0 [0142.575] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c370 [0142.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.576] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3658b8 [0142.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c370 | out: hHeap=0x310000) returned 1 [0142.576] GetLastError () returned 0x0 [0142.576] SetLastError (dwErrCode=0x0) [0142.577] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0142.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0142.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0142.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x38c2a0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o3YUTB6kWZJFeepfmCEnbwyP1", lpUsedDefaultChar=0x0) returned 25 [0142.577] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3658b8 | out: hHeap=0x310000) returned 1 [0142.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0142.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5c96138 [0142.609] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b148 [0142.610] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1029\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0142.610] WriteFile (in: hFile=0x518, lpBuffer=0x5c96138*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x5c96138*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6c, lpOverlapped=0x0) returned 1 [0142.611] CloseHandle (hObject=0x518) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b148 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c96138 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0142.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e54c8 | out: hHeap=0x310000) returned 1 [0142.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0142.612] CryptDestroyKey (hKey=0x5261788) returned 1 [0142.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0142.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398fe0 | out: hHeap=0x310000) returned 1 [0142.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0142.612] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0142.612] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0142.612] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.612] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0142.651] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.651] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0142.651] CloseHandle (hObject=0x518) returned 1 [0142.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0142.652] RmStartSession () returned 0x0 [0142.655] RmRegisterResources () returned 0x0 [0142.659] RmGetList () returned 0x0 [0143.108] RmShutdown () returned 0x0 [0145.673] RmEndSession () returned 0x0 [0145.674] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261988) returned 1 [0145.674] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0145.674] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0145.675] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0145.675] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0145.675] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=80060) returned 1 [0145.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12090 [0145.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf9020 [0145.841] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0145.841] ReadFile (in: hFile=0x518, lpBuffer=0x4cf9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x4cf9040*, lpNumberOfBytesRead=0x3a2f678*=0x138bc, lpOverlapped=0x0) returned 1 [0145.844] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0145.844] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.844] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.844] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.844] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.844] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.844] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.844] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.844] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c120a0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0145.845] WriteFile (in: hFile=0x518, lpBuffer=0x5c120a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5c120a0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0145.846] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0145.846] WriteFile (in: hFile=0x518, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0145.846] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf9020 | out: hHeap=0x310000) returned 1 [0145.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12090 | out: hHeap=0x310000) returned 1 [0145.900] CloseHandle (hObject=0x518) returned 1 [0145.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0145.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0145.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0145.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0145.903] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.903] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1040\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0145.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2720 [0145.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398188 [0145.905] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] GetLastError () returned 0x0 [0145.905] SetLastError (dwErrCode=0x0) [0145.905] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0145.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x3a2f4b0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0145.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0145.905] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0145.905] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1040\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0145.906] WriteFile (in: hFile=0x518, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe59, lpOverlapped=0x0) returned 1 [0145.907] CloseHandle (hObject=0x518) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398188 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2720 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0145.908] CryptDestroyKey (hKey=0x5261988) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0145.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ed0 | out: hHeap=0x310000) returned 1 [0145.908] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0145.908] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0145.910] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.910] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0145.911] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.911] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0145.912] CloseHandle (hObject=0x518) returned 1 [0145.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a30 [0145.912] RmStartSession () returned 0x0 [0146.485] RmRegisterResources () returned 0x0 [0146.489] RmGetList () returned 0x0 [0147.213] RmShutdown () returned 0x0 [0149.339] RmEndSession () returned 0x0 [0149.340] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261808) returned 1 [0149.340] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0149.340] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x80) returned 1 [0149.340] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0149.340] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0149.340] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=54456) returned 1 [0149.340] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3a4b20 [0149.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5909020 [0149.676] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0149.676] ReadFile (in: hFile=0x5e8, lpBuffer=0x5909040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x5909040*, lpNumberOfBytesRead=0x3a2f678*=0xd4b8, lpOverlapped=0x0) returned 1 [0149.680] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0149.680] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.680] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.680] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.680] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.680] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.680] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.680] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.680] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.680] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.680] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.681] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.681] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.681] CryptEncrypt (in: hKey=0x5261808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a4b40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0149.681] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a4b40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a4b40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0149.681] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0149.681] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0149.681] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0149.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5909020 | out: hHeap=0x310000) returned 1 [0149.866] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4b20 | out: hHeap=0x310000) returned 1 [0149.866] CloseHandle (hObject=0x5e8) returned 1 [0149.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0149.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0149.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0149.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0149.868] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0149.868] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1049\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0149.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0149.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0149.869] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.869] GetLastError () returned 0x0 [0149.869] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0149.870] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] GetLastError () returned 0x0 [0149.870] SetLastError (dwErrCode=0x0) [0149.870] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0149.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0149.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0149.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9XOqcHODkUzIb3wxAPZ", cchWideChar=19, lpMultiByteStr=0x38c520, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9XOqcHODkUzIb3wxAPZ", lpUsedDefaultChar=0x0) returned 19 [0149.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0149.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0149.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0149.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c3a048 [0149.871] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0149.872] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe66, lpOverlapped=0x0) returned 1 [0149.872] CloseHandle (hObject=0x5e8) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a048 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0149.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0149.873] CryptDestroyKey (hKey=0x5261808) returned 1 [0149.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399a30 | out: hHeap=0x310000) returned 1 [0149.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0149.874] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a70 | out: hHeap=0x310000) returned 1 [0149.874] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0149.874] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0149.874] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.874] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0149.998] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.998] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0149.998] CloseHandle (hObject=0x5e8) returned 1 [0149.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a27f0 [0149.998] RmStartSession () returned 0x0 [0150.147] RmRegisterResources () returned 0x0 [0150.151] RmGetList () returned 0x0 [0150.819] RmShutdown () returned 0x0 [0153.083] RmEndSession () returned 0x0 [0153.084] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261288) returned 1 [0153.084] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0153.084] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0153.084] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0153.084] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0153.085] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=39042) returned 1 [0153.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0153.085] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58c7020 [0153.496] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0153.496] ReadFile (in: hFile=0x5e8, lpBuffer=0x58c7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x58c7040*, lpNumberOfBytesRead=0x3a2f678*=0x9882, lpOverlapped=0x0) returned 1 [0153.499] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0153.499] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0153.499] WriteFile (in: hFile=0x5e8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0153.499] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0153.499] WriteFile (in: hFile=0x5e8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0153.499] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0153.499] WriteFile (in: hFile=0x5e8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0153.500] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0153.500] WriteFile (in: hFile=0x5e8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0153.500] CryptEncrypt (in: hKey=0x5261288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0153.500] WriteFile (in: hFile=0x5e8, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0153.500] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0153.500] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0153.500] WriteFile (in: hFile=0x5e8, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0153.500] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58c7020 | out: hHeap=0x310000) returned 1 [0153.656] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0153.656] CloseHandle (hObject=0x5e8) returned 1 [0153.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0153.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0360 [0153.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1bc0 [0153.657] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0153.657] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0153.657] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\Client\\UiInfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0153.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0153.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0153.722] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0153.722] GetLastError () returned 0x0 [0153.722] SetLastError (dwErrCode=0x0) [0153.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0153.722] GetLastError () returned 0x0 [0153.722] SetLastError (dwErrCode=0x0) [0153.722] GetLastError () returned 0x0 [0153.722] SetLastError (dwErrCode=0x0) [0153.722] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0153.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0153.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x3a2f4b0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0153.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0153.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0153.722] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\client\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0153.723] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe54, lpOverlapped=0x0) returned 1 [0153.724] CloseHandle (hObject=0x5e8) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1bc0 | out: hHeap=0x310000) returned 1 [0153.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0153.727] CryptDestroyKey (hKey=0x5261288) returned 1 [0153.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a27f0 | out: hHeap=0x310000) returned 1 [0153.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50608a0 | out: hHeap=0x310000) returned 1 [0153.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c195b0 | out: hHeap=0x310000) returned 1 [0153.795] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0153.795] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0153.795] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.795] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0153.840] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.840] ReadFile (in: hFile=0x5c8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0153.840] CloseHandle (hObject=0x5c8) returned 1 [0153.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0360 [0153.840] RmStartSession () returned 0x0 [0154.014] RmRegisterResources () returned 0x0 [0154.017] RmGetList () returned 0x0 [0154.365] RmShutdown () returned 0x0 [0160.997] RmEndSession () returned 0x0 [0160.998] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260e88) returned 1 [0160.998] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0160.998] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", dwFileAttributes=0x80) returned 1 [0160.998] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0160.998] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0160.998] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=1150) returned 1 [0160.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x53456e0 [0160.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6f22020 [0161.298] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0161.298] ReadFile (in: hFile=0x680, lpBuffer=0x6f22040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x6f22040*, lpNumberOfBytesRead=0x3a2f678*=0x47e, lpOverlapped=0x0) returned 1 [0161.300] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0161.300] CryptEncrypt (in: hKey=0x5260e88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5345700*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5345700*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0161.300] WriteFile (in: hFile=0x680, lpBuffer=0x5345700*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5345700*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0161.300] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0161.300] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0161.301] WriteFile (in: hFile=0x680, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0161.301] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6f22020 | out: hHeap=0x310000) returned 1 [0166.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53456e0 | out: hHeap=0x310000) returned 1 [0166.731] CloseHandle (hObject=0x680) returned 1 [0166.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0166.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0166.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0ae0 [0166.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3de0 [0166.732] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0166.732] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0166.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f02e8 [0166.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3993a8 [0166.733] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0166.733] GetLastError () returned 0x0 [0166.733] SetLastError (dwErrCode=0x0) [0166.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0166.733] GetLastError () returned 0x0 [0166.733] SetLastError (dwErrCode=0x0) [0166.733] GetLastError () returned 0x0 [0166.733] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] GetLastError () returned 0x0 [0166.734] SetLastError (dwErrCode=0x0) [0166.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0166.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0166.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x3a2f4b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8hSHAmSXv4", lpUsedDefaultChar=0x0) returned 11 [0166.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0166.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0166.734] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0810 [0166.734] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0166.735] WriteFile (in: hFile=0x680, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe5e, lpOverlapped=0x0) returned 1 [0166.736] CloseHandle (hObject=0x680) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0810 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3993a8 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f02e8 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3de0 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0ae0 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0166.737] CryptDestroyKey (hKey=0x5260e88) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b1c0 | out: hHeap=0x310000) returned 1 [0166.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5cb0 | out: hHeap=0x310000) returned 1 [0166.737] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0166.737] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0166.738] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.738] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0166.740] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.740] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0166.740] CloseHandle (hObject=0x680) returned 1 [0166.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5203b10 [0166.740] RmStartSession () returned 0x0 [0166.742] RmRegisterResources () returned 0x0 [0166.746] RmGetList () returned 0x0 [0170.105] RmShutdown () returned 0x0 [0176.441] RmEndSession () returned 0x0 [0176.442] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260f88) returned 1 [0176.442] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0176.442] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x20) returned 1 [0176.443] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0176.443] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0176.443] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=69632) returned 1 [0176.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0176.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6663020 [0176.462] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0176.462] ReadFile (in: hFile=0x680, lpBuffer=0x6663040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x6663040*, lpNumberOfBytesRead=0x3a2f678*=0x11000, lpOverlapped=0x0) returned 1 [0176.488] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0176.488] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.488] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.489] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.489] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.490] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0176.490] WriteFile (in: hFile=0x680, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0176.490] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0176.490] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0176.490] WriteFile (in: hFile=0x680, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0176.490] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6663020 | out: hHeap=0x310000) returned 1 [0176.495] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0176.495] CloseHandle (hObject=0x680) returned 1 [0176.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0176.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5dfeb20 [0176.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321360 [0176.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5dff300 [0176.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dfeb20 | out: hHeap=0x310000) returned 1 [0176.497] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0176.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321bb0 [0176.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0176.500] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0176.500] GetLastError () returned 0x0 [0176.500] SetLastError (dwErrCode=0x0) [0176.500] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4880 [0176.500] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] GetLastError () returned 0x0 [0176.501] SetLastError (dwErrCode=0x0) [0176.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0176.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4880 | out: hHeap=0x310000) returned 1 [0176.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x3a2f4b0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0176.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0176.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0176.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398380 [0176.501] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0176.502] WriteFile (in: hFile=0x680, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe5b, lpOverlapped=0x0) returned 1 [0176.503] CloseHandle (hObject=0x680) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398380 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321bb0 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dff300 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321360 | out: hHeap=0x310000) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0176.503] CryptDestroyKey (hKey=0x5260f88) returned 1 [0176.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5203b10 | out: hHeap=0x310000) returned 1 [0176.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c150 | out: hHeap=0x310000) returned 1 [0176.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e80 | out: hHeap=0x310000) returned 1 [0176.504] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0176.504] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0176.504] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.504] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0176.920] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.920] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0176.920] CloseHandle (hObject=0x680) returned 1 [0176.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0176.920] RmStartSession () returned 0x0 [0177.215] RmRegisterResources () returned 0x0 [0177.219] RmGetList () returned 0x0 [0177.548] RmShutdown () returned 0x0 [0178.529] RmEndSession () returned 0x0 [0178.529] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261148) returned 1 [0178.530] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0178.530] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0178.530] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0178.530] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0178.530] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=69632) returned 1 [0178.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5339028 [0178.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x666e020 [0178.657] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0178.658] ReadFile (in: hFile=0x680, lpBuffer=0x666e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x666e040*, lpNumberOfBytesRead=0x3a2f678*=0x11000, lpOverlapped=0x0) returned 1 [0178.660] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.660] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.660] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.660] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.660] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.660] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.660] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.661] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.661] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.661] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.661] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.661] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.661] CryptEncrypt (in: hKey=0x5261148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5339040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0178.661] WriteFile (in: hFile=0x680, lpBuffer=0x5339040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5339040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0178.661] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0178.661] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0178.662] WriteFile (in: hFile=0x680, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0178.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x666e020 | out: hHeap=0x310000) returned 1 [0179.205] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5339028 | out: hHeap=0x310000) returned 1 [0179.205] CloseHandle (hObject=0x680) returned 1 [0179.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0179.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322d80 [0179.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0179.207] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322c50 [0179.207] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322d80 | out: hHeap=0x310000) returned 1 [0179.207] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0179.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0179.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0179.208] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] GetLastError () returned 0x0 [0179.208] SetLastError (dwErrCode=0x0) [0179.208] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0179.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] GetLastError () returned 0x0 [0179.209] SetLastError (dwErrCode=0x0) [0179.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0179.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0179.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0179.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x38c1b0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z6SlG4j98JbFmSQSeg", lpUsedDefaultChar=0x0) returned 18 [0179.209] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0179.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0179.209] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bad110 [0179.210] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0179.210] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0179.210] WriteFile (in: hFile=0x680, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe65, lpOverlapped=0x0) returned 1 [0179.211] CloseHandle (hObject=0x680) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322c50 | out: hHeap=0x310000) returned 1 [0179.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0179.213] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0179.213] CryptDestroyKey (hKey=0x5261148) returned 1 [0179.213] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0179.213] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea588 | out: hHeap=0x310000) returned 1 [0179.213] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6150 | out: hHeap=0x310000) returned 1 [0179.213] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0179.213] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0179.213] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.213] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0179.450] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.450] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0179.450] CloseHandle (hObject=0x680) returned 1 [0179.450] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0179.450] RmStartSession () returned 0x0 [0179.591] RmRegisterResources () returned 0x0 [0179.595] RmGetList () returned 0x0 [0180.025] RmShutdown () returned 0x0 [0182.164] RmEndSession () returned 0x0 [0182.165] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261248) returned 1 [0182.165] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0182.165] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0182.166] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0182.166] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0182.166] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=69632) returned 1 [0182.166] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5413ca0 [0182.166] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c4020 [0182.567] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0182.567] ReadFile (in: hFile=0x680, lpBuffer=0x65c4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x65c4040*, lpNumberOfBytesRead=0x3a2f678*=0x11000, lpOverlapped=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0182.570] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.570] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.570] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.570] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.570] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.570] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.570] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.570] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.571] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.571] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.571] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.571] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.571] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.571] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.571] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.571] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.571] CryptEncrypt (in: hKey=0x5261248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0182.571] WriteFile (in: hFile=0x680, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0182.572] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0182.572] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0182.572] WriteFile (in: hFile=0x680, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0182.572] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c4020 | out: hHeap=0x310000) returned 1 [0182.733] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5413ca0 | out: hHeap=0x310000) returned 1 [0182.734] CloseHandle (hObject=0x680) returned 1 [0182.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0182.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0a68 [0182.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0182.735] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0bd0 [0182.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0a68 | out: hHeap=0x310000) returned 1 [0182.735] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0182.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0182.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0182.736] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0182.736] GetLastError () returned 0x0 [0182.736] SetLastError (dwErrCode=0x0) [0182.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0182.736] GetLastError () returned 0x0 [0182.736] SetLastError (dwErrCode=0x0) [0182.736] GetLastError () returned 0x0 [0182.736] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] GetLastError () returned 0x0 [0182.737] SetLastError (dwErrCode=0x0) [0182.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b730 [0182.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab6d8 [0182.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.738] SetLastError (dwErrCode=0x0) [0182.738] GetLastError () returned 0x0 [0182.739] SetLastError (dwErrCode=0x0) [0182.739] GetLastError () returned 0x0 [0182.739] SetLastError (dwErrCode=0x0) [0182.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0182.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0182.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0182.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", cchWideChar=31, lpMultiByteStr=0x38c1b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uaOhaMsNTlR0Fez6LnN1BIXvNn9rXxP", lpUsedDefaultChar=0x0) returned 31 [0182.739] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab6d8 | out: hHeap=0x310000) returned 1 [0182.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540b990 [0182.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x540f3b0 [0182.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0182.739] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0182.740] WriteFile (in: hFile=0x680, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe72, lpOverlapped=0x0) returned 1 [0182.741] CloseHandle (hObject=0x680) returned 1 [0182.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0182.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0182.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0bd0 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0182.742] CryptDestroyKey (hKey=0x5261248) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a20a0 | out: hHeap=0x310000) returned 1 [0182.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6bf0 | out: hHeap=0x310000) returned 1 [0182.742] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0182.742] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0182.742] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.742] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0182.765] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.765] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0182.765] CloseHandle (hObject=0x680) returned 1 [0182.765] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0182.766] RmStartSession () returned 0x0 [0183.205] RmRegisterResources () returned 0x0 [0183.206] RmGetList () returned 0x0 [0183.653] RmShutdown () returned 0x0 [0185.109] RmEndSession () returned 0x0 [0185.110] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260fc8) returned 1 [0185.110] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0185.110] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0185.111] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0185.111] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0185.111] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=69632) returned 1 [0185.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa0f0 [0185.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6948020 [0185.781] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0185.781] ReadFile (in: hFile=0x49c, lpBuffer=0x6948040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x6948040*, lpNumberOfBytesRead=0x3a2f678*=0x11000, lpOverlapped=0x0) returned 1 [0185.813] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0185.813] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.813] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.813] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.813] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.813] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.814] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0185.814] WriteFile (in: hFile=0x49c, lpBuffer=0x61fa100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61fa100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0185.815] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0185.815] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0185.815] WriteFile (in: hFile=0x49c, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0185.815] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6948020 | out: hHeap=0x310000) returned 1 [0187.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa0f0 | out: hHeap=0x310000) returned 1 [0187.622] CloseHandle (hObject=0x49c) returned 1 [0187.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0187.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0187.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0187.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0187.627] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0187.627] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0187.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0187.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0187.628] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.628] SetLastError (dwErrCode=0x0) [0187.628] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] GetLastError () returned 0x0 [0187.629] SetLastError (dwErrCode=0x0) [0187.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x3a2f4b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K5peP9WcLDHI", lpUsedDefaultChar=0x0) returned 12 [0187.629] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0187.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0187.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0187.629] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0187.630] WriteFile (in: hFile=0x49c, lpBuffer=0x540ab08*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x540ab08*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe5f, lpOverlapped=0x0) returned 1 [0187.631] CloseHandle (hObject=0x49c) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0187.631] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea610 | out: hHeap=0x310000) returned 1 [0187.631] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6c40 | out: hHeap=0x310000) returned 1 [0187.631] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0187.631] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0187.632] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.632] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0187.646] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.647] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0187.647] CloseHandle (hObject=0x49c) returned 1 [0187.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9f50 [0187.647] RmStartSession () returned 0x0 [0187.650] RmRegisterResources () returned 0x0 [0187.654] RmGetList () returned 0x0 [0187.953] RmShutdown () returned 0x0 [0188.233] RmEndSession () returned 0x0 [0188.234] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260c88) returned 1 [0188.234] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0188.234] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0188.234] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0188.234] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0188.234] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=69632) returned 1 [0188.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0188.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6883020 [0189.015] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0189.015] ReadFile (in: hFile=0x49c, lpBuffer=0x6883040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x6883040*, lpNumberOfBytesRead=0x3a2f678*=0x11000, lpOverlapped=0x0) returned 1 [0189.017] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0189.017] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.017] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.018] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.018] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.019] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0189.019] WriteFile (in: hFile=0x49c, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0189.019] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0189.019] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0189.019] WriteFile (in: hFile=0x49c, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0189.019] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6883020 | out: hHeap=0x310000) returned 1 [0190.749] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0190.749] CloseHandle (hObject=0x49c) returned 1 [0190.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0190.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51cec50 [0190.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9e00 [0190.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51ceea8 [0190.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cec50 | out: hHeap=0x310000) returned 1 [0190.751] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51ca1f0 [0190.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.752] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] GetLastError () returned 0x0 [0190.752] SetLastError (dwErrCode=0x0) [0190.752] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0190.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.753] SetLastError (dwErrCode=0x0) [0190.753] GetLastError () returned 0x0 [0190.754] SetLastError (dwErrCode=0x0) [0190.754] GetLastError () returned 0x0 [0190.754] SetLastError (dwErrCode=0x0) [0190.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bacfd8 [0190.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0190.754] GetLastError () returned 0x0 [0190.754] SetLastError (dwErrCode=0x0) [0190.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0190.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0190.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0190.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c3e0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0190.754] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bacfd8 | out: hHeap=0x310000) returned 1 [0190.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0190.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540d6a0 [0190.754] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0190.754] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0190.755] WriteFile (in: hFile=0x49c, lpBuffer=0x540d6a0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x540d6a0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6c, lpOverlapped=0x0) returned 1 [0190.756] CloseHandle (hObject=0x49c) returned 1 [0190.756] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ca1f0 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ceea8 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9e00 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0190.757] CryptDestroyKey (hKey=0x5260c88) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9f50 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c922e0 | out: hHeap=0x310000) returned 1 [0190.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365c28 | out: hHeap=0x310000) returned 1 [0190.757] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0190.757] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0190.757] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.757] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0190.791] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.791] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0190.791] CloseHandle (hObject=0x49c) returned 1 [0190.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0190.791] RmStartSession () returned 0x0 [0190.876] RmRegisterResources () returned 0x0 [0190.880] RmGetList () returned 0x0 [0191.249] RmShutdown () returned 0x0 [0192.554] RmEndSession () returned 0x0 [0192.555] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x35d988) returned 1 [0192.555] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0192.555] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0192.555] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0192.555] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0192.555] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=1052672) returned 1 [0192.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61ba0e8 [0192.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589a020 [0192.888] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0192.888] ReadFile (in: hFile=0x49c, lpBuffer=0x589a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x589a040*, lpNumberOfBytesRead=0x3a2f678*=0x100000, lpOverlapped=0x0) returned 1 [0192.899] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.899] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.899] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.900] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.900] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.901] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.901] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.902] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.902] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.903] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.903] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.904] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.904] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.905] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.906] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.906] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.907] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.907] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.908] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.908] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.909] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.909] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.910] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.910] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.911] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.911] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.912] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.912] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.913] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.913] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.914] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.914] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.915] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.915] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.915] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.915] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.915] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.915] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.915] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.915] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.915] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.915] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.920] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.920] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.920] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.920] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.920] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.920] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.920] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.920] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.920] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.920] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.921] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.921] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.921] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.921] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.921] CryptEncrypt (in: hKey=0x35d988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x61ba100*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0192.921] WriteFile (in: hFile=0x49c, lpBuffer=0x61ba100*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x61ba100*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0192.921] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0192.921] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0192.921] WriteFile (in: hFile=0x49c, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0192.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589a020 | out: hHeap=0x310000) returned 1 [0192.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61ba0e8 | out: hHeap=0x310000) returned 1 [0192.992] CloseHandle (hObject=0x49c) returned 1 [0193.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0193.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532b740 [0193.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0193.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532ab60 [0193.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532b740 | out: hHeap=0x310000) returned 1 [0193.008] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0193.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0193.009] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0193.009] GetLastError () returned 0x0 [0193.009] SetLastError (dwErrCode=0x0) [0193.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0193.009] GetLastError () returned 0x0 [0193.009] SetLastError (dwErrCode=0x0) [0193.009] GetLastError () returned 0x0 [0193.009] SetLastError (dwErrCode=0x0) [0193.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0193.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0193.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x3a2f4b0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T", lpUsedDefaultChar=0x0) returned 1 [0193.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540c818 [0193.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0193.009] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0193.010] WriteFile (in: hFile=0x49c, lpBuffer=0x540c818*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x540c818*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe54, lpOverlapped=0x0) returned 1 [0193.011] CloseHandle (hObject=0x49c) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540c818 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532ab60 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0193.011] CryptDestroyKey (hKey=0x35d988) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0193.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0193.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44df8 | out: hHeap=0x310000) returned 1 [0193.012] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0193.012] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0193.012] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.012] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0193.013] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.013] ReadFile (in: hFile=0x49c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0193.013] CloseHandle (hObject=0x49c) returned 1 [0193.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532b318 [0193.013] RmStartSession () returned 0x0 [0193.014] RmRegisterResources () returned 0x0 [0193.018] RmGetList () returned 0x0 [0193.421] RmShutdown () returned 0x0 [0194.781] RmEndSession () returned 0x0 [0194.782] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261ac8) returned 1 [0194.782] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0194.782] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash", dwFileAttributes=0x20) returned 1 [0194.782] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0194.782] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0194.782] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=102) returned 1 [0194.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b80fc8 [0194.783] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ef020 [0195.074] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0195.074] ReadFile (in: hFile=0x49c, lpBuffer=0x49ef040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x49ef040*, lpNumberOfBytesRead=0x3a2f678*=0x66, lpOverlapped=0x0) returned 1 [0195.074] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0195.075] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b80fe0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b80fe0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0195.075] WriteFile (in: hFile=0x49c, lpBuffer=0x4b80fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b80fe0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x49c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x49c, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0195.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ef020 | out: hHeap=0x310000) returned 1 [0195.396] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b80fc8 | out: hHeap=0x310000) returned 1 [0195.396] CloseHandle (hObject=0x49c) returned 1 [0195.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0195.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5355808 [0195.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x54e4498 [0195.397] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356bb8 [0195.397] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5355808 | out: hHeap=0x310000) returned 1 [0195.397] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.bdcddcbaad"), dwFlags=0x1) returned 1 [0195.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x54e41a0 [0195.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc6f8 [0195.398] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc560 [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] GetLastError () returned 0x0 [0195.398] SetLastError (dwErrCode=0x0) [0195.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc560 | out: hHeap=0x310000) returned 1 [0195.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B4f0ZF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0195.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B4f0ZF", cchWideChar=6, lpMultiByteStr=0x3a2f4b0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B4f0ZF", lpUsedDefaultChar=0x0) returned 6 [0195.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0195.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5355808 [0195.399] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0195.421] WriteFile (in: hFile=0x56c, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe59, lpOverlapped=0x0) returned 1 [0195.422] CloseHandle (hObject=0x56c) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5355808 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc6f8 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e41a0 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356bb8 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e4498 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0195.422] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532b318 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c3b0 | out: hHeap=0x310000) returned 1 [0195.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44c68 | out: hHeap=0x310000) returned 1 [0195.422] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0195.422] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0195.422] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.422] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0195.425] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.425] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0195.425] CloseHandle (hObject=0x56c) returned 1 [0195.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5357398 [0195.425] RmStartSession () returned 0x0 [0195.427] RmRegisterResources () returned 0x0 [0195.431] RmGetList () returned 0x0 [0195.862] RmShutdown () returned 0x0 [0196.917] RmEndSession () returned 0x0 [0196.919] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x52619c8) returned 1 [0196.919] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0196.919] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0196.919] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.919] CryptDestroyKey (hKey=0x52619c8) returned 1 [0196.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5357398 | out: hHeap=0x310000) returned 1 [0196.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92238 | out: hHeap=0x310000) returned 1 [0196.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08230 | out: hHeap=0x310000) returned 1 [0196.919] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0196.919] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0196.921] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.921] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0197.237] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.237] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0197.237] CloseHandle (hObject=0x56c) returned 1 [0197.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5b90 [0197.238] RmStartSession () returned 0x0 [0197.240] RmRegisterResources () returned 0x0 [0197.244] RmGetList () returned 0x0 [0197.760] RmShutdown () returned 0x0 [0200.026] RmEndSession () returned 0x0 [0200.027] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261988) returned 1 [0200.027] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0200.027] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", dwFileAttributes=0x20) returned 0 [0200.028] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.028] CryptDestroyKey (hKey=0x5261988) returned 1 [0200.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5b90 | out: hHeap=0x310000) returned 1 [0200.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92580 | out: hHeap=0x310000) returned 1 [0200.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c082d0 | out: hHeap=0x310000) returned 1 [0200.028] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0200.028] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0200.028] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.028] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0200.165] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.165] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0200.165] CloseHandle (hObject=0x56c) returned 1 [0200.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a87e0 [0200.165] RmStartSession () returned 0x0 [0200.167] RmRegisterResources () returned 0x0 [0200.171] RmGetList () returned 0x0 [0203.708] RmShutdown () returned 0x0 [0204.223] RmEndSession () returned 0x0 [0204.746] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261588) returned 1 [0204.746] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0204.746] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui", dwFileAttributes=0x20) returned 0 [0204.746] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.746] CryptDestroyKey (hKey=0x5261588) returned 1 [0204.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a87e0 | out: hHeap=0x310000) returned 1 [0204.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cb68 | out: hHeap=0x310000) returned 1 [0204.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07d80 | out: hHeap=0x310000) returned 1 [0204.746] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0204.746] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0204.747] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.747] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0204.785] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.786] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0204.786] CloseHandle (hObject=0x500) returned 1 [0204.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92040 [0204.786] RmStartSession () returned 0x0 [0204.788] RmRegisterResources () returned 0x0 [0204.792] RmGetList () returned 0x0 [0205.198] RmShutdown () returned 0x0 [0207.046] RmEndSession () returned 0x0 [0207.047] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261988) returned 1 [0207.047] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0207.047] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0207.047] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.047] CryptDestroyKey (hKey=0x5261988) returned 1 [0207.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92040 | out: hHeap=0x310000) returned 1 [0207.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92eb0 | out: hHeap=0x310000) returned 1 [0207.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08690 | out: hHeap=0x310000) returned 1 [0207.047] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0207.047] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0207.048] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.048] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0207.084] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.084] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0207.084] CloseHandle (hObject=0x500) returned 1 [0207.084] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53eba48 [0207.084] RmStartSession () returned 0x0 [0207.086] RmRegisterResources () returned 0x0 [0207.086] RmGetList () returned 0x0 [0208.177] RmShutdown () returned 0x0 [0210.647] RmEndSession () returned 0x0 [0210.923] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x35db88) returned 1 [0210.923] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0210.923] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", dwFileAttributes=0x20) returned 0 [0210.924] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.924] CryptDestroyKey (hKey=0x35db88) returned 1 [0210.924] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53eba48 | out: hHeap=0x310000) returned 1 [0210.924] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0210.924] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c087d0 | out: hHeap=0x310000) returned 1 [0210.924] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0210.924] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0210.924] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.925] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0210.926] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.926] ReadFile (in: hFile=0x618, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0210.926] CloseHandle (hObject=0x618) returned 1 [0210.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x53f8358 [0210.927] RmStartSession () returned 0x0 [0210.929] RmRegisterResources () returned 0x0 [0210.934] RmGetList () returned 0x0 [0211.447] RmShutdown () returned 0x0 [0212.554] RmEndSession () returned 0x0 [0212.555] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260bc8) returned 1 [0212.555] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0212.555] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", dwFileAttributes=0x20) returned 0 [0212.555] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.555] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0212.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f8358 | out: hHeap=0x310000) returned 1 [0212.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ec8d0 | out: hHeap=0x310000) returned 1 [0212.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5560 | out: hHeap=0x310000) returned 1 [0212.556] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0212.556] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0212.662] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.663] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0212.802] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.802] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0212.802] CloseHandle (hObject=0x4ac) returned 1 [0212.802] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd290 [0212.802] RmStartSession () returned 0x0 [0212.914] RmRegisterResources () returned 0x0 [0212.918] RmGetList () returned 0x0 [0213.232] RmShutdown () returned 0x0 [0214.676] RmEndSession () returned 0x0 [0214.856] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260f88) returned 1 [0214.856] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0214.856] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml", dwFileAttributes=0x20) returned 0 [0214.856] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.857] CryptDestroyKey (hKey=0x5260f88) returned 1 [0214.857] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd290 | out: hHeap=0x310000) returned 1 [0214.857] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0214.857] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a59c0 | out: hHeap=0x310000) returned 1 [0214.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0214.857] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0214.919] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.919] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0214.933] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.933] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0214.933] CloseHandle (hObject=0x4d4) returned 1 [0214.933] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0214.933] RmStartSession () returned 0x0 [0214.937] RmRegisterResources () returned 0x0 [0214.941] RmGetList () returned 0x0 [0215.163] RmShutdown () returned 0x0 [0218.473] RmEndSession () returned 0x0 [0218.473] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261608) returned 1 [0218.474] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0218.474] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml", dwFileAttributes=0x20) returned 0 [0218.474] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.474] CryptDestroyKey (hKey=0x5261608) returned 1 [0218.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0218.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ebac8 | out: hHeap=0x310000) returned 1 [0218.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6140 | out: hHeap=0x310000) returned 1 [0218.474] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0218.474] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0218.474] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.474] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0218.481] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.481] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0218.481] CloseHandle (hObject=0x4d4) returned 1 [0218.481] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0218.482] RmStartSession () returned 0x0 [0218.485] RmRegisterResources () returned 0x0 [0218.489] RmGetList () returned 0x0 [0220.761] RmShutdown () returned 0x0 [0223.909] RmEndSession () returned 0x0 [0223.909] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x52614c8) returned 1 [0223.909] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0223.910] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml", dwFileAttributes=0x20) returned 0 [0223.910] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.910] CryptDestroyKey (hKey=0x52614c8) returned 1 [0223.910] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0223.910] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb688 | out: hHeap=0x310000) returned 1 [0223.910] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c147e0 | out: hHeap=0x310000) returned 1 [0223.910] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0223.910] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0223.910] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.910] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0223.912] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.912] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0223.912] CloseHandle (hObject=0x4d4) returned 1 [0223.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3eec78 [0223.912] RmStartSession () returned 0x0 [0223.915] RmRegisterResources () returned 0x0 [0225.114] RmGetList () returned 0x0 [0225.229] RmShutdown () returned 0x0 [0228.886] RmEndSession () returned 0x0 [0228.887] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x52613c8) returned 1 [0228.887] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0228.888] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0228.888] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.888] CryptDestroyKey (hKey=0x52613c8) returned 1 [0228.888] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eec78 | out: hHeap=0x310000) returned 1 [0228.888] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eed20 | out: hHeap=0x310000) returned 1 [0228.888] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c144c0 | out: hHeap=0x310000) returned 1 [0228.888] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0228.888] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0228.889] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.889] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0228.895] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.895] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0228.895] CloseHandle (hObject=0x4d4) returned 1 [0228.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0228.895] RmStartSession () returned 0x0 [0228.899] RmRegisterResources () returned 0x0 [0229.456] RmGetList () returned 0x0 [0229.494] RmShutdown () returned 0x0 [0230.589] RmEndSession () returned 0x0 [0231.722] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261088) returned 1 [0231.722] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0231.722] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb", dwFileAttributes=0x20) returned 1 [0231.723] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0231.723] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0231.723] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=17048) returned 1 [0231.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5488db8 [0231.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ef020 [0231.744] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0231.744] ReadFile (in: hFile=0x518, lpBuffer=0x49ef040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x49ef040*, lpNumberOfBytesRead=0x3a2f678*=0x4298, lpOverlapped=0x0) returned 1 [0231.775] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0231.775] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0231.775] WriteFile (in: hFile=0x518, lpBuffer=0x5488dc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5488dc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0231.775] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0231.775] WriteFile (in: hFile=0x518, lpBuffer=0x5488dc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5488dc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0231.775] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5488dc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0231.775] WriteFile (in: hFile=0x518, lpBuffer=0x5488dc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5488dc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0231.775] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0231.776] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0231.776] WriteFile (in: hFile=0x518, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0231.776] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ef020 | out: hHeap=0x310000) returned 1 [0231.781] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5488db8 | out: hHeap=0x310000) returned 1 [0231.781] CloseHandle (hObject=0x518) returned 1 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0231.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0231.782] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.bdcddcbaad"), dwFlags=0x1) returned 1 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0231.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19858 [0231.783] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.783] SetLastError (dwErrCode=0x0) [0231.783] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6f8 [0231.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x52f9700 [0231.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6f8 | out: hHeap=0x310000) returned 1 [0231.784] GetLastError () returned 0x0 [0231.784] SetLastError (dwErrCode=0x0) [0231.784] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] GetLastError () returned 0x0 [0231.785] SetLastError (dwErrCode=0x0) [0231.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0231.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0231.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0231.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", cchWideChar=31, lpMultiByteStr=0x38c160, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M7aos8xxAOFpHaFKH6OBFVedbuMmJ5k", lpUsedDefaultChar=0x0) returned 31 [0231.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52f9700 | out: hHeap=0x310000) returned 1 [0231.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0231.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e9bc0 [0231.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0231.785] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\VSTO\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0232.608] WriteFile (in: hFile=0x558, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe72, lpOverlapped=0x0) returned 1 [0232.609] CloseHandle (hObject=0x558) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19858 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0232.610] CryptDestroyKey (hKey=0x5261088) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571808 | out: hHeap=0x310000) returned 1 [0232.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14b50 | out: hHeap=0x310000) returned 1 [0232.610] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0232.610] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0232.611] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.611] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0232.613] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.613] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0232.613] CloseHandle (hObject=0x558) returned 1 [0232.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0232.613] RmStartSession () returned 0x0 [0232.958] RmRegisterResources () returned 0x0 [0232.959] RmGetList () returned 0x0 [0233.115] RmShutdown () returned 0x0 [0233.732] RmEndSession () returned 0x0 [0233.918] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261348) returned 1 [0233.918] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0233.919] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", dwFileAttributes=0x20) returned 0 [0233.919] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.919] CryptDestroyKey (hKey=0x5261348) returned 1 [0233.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0233.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571510 | out: hHeap=0x310000) returned 1 [0233.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572d88 | out: hHeap=0x310000) returned 1 [0233.919] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0233.919] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0233.919] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.919] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0233.941] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.941] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0233.941] CloseHandle (hObject=0x584) returned 1 [0233.941] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0233.941] RmStartSession () returned 0x0 [0233.944] RmRegisterResources () returned 0x0 [0233.944] RmGetList () returned 0x0 [0235.769] RmShutdown () returned 0x0 [0235.974] RmEndSession () returned 0x0 [0236.030] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261048) returned 1 [0236.030] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0236.030] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", dwFileAttributes=0x20) returned 0 [0236.030] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.030] CryptDestroyKey (hKey=0x5261048) returned 1 [0236.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0236.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0236.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572ce8 | out: hHeap=0x310000) returned 1 [0236.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0236.030] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0236.031] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.031] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0236.055] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.055] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0236.055] CloseHandle (hObject=0x584) returned 1 [0236.055] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19e70 [0236.055] RmStartSession () returned 0x0 [0236.342] RmRegisterResources () returned 0x0 [0236.342] RmGetList () returned 0x0 [0236.414] RmShutdown () returned 0x0 [0237.680] RmEndSession () returned 0x0 [0237.854] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260f08) returned 1 [0237.854] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0237.854] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf", dwFileAttributes=0x20) returned 1 [0237.854] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0237.854] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0237.854] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=51236) returned 1 [0237.854] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0237.854] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e6020 [0237.873] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0237.873] ReadFile (in: hFile=0x500, lpBuffer=0x49e6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x49e6040*, lpNumberOfBytesRead=0x3a2f678*=0xc824, lpOverlapped=0x0) returned 1 [0238.036] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0238.036] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.036] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.036] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.036] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.036] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.036] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.036] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.036] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.037] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.037] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.037] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.037] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.037] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0238.037] WriteFile (in: hFile=0x500, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0238.037] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0238.037] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0238.037] WriteFile (in: hFile=0x500, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0238.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e6020 | out: hHeap=0x310000) returned 1 [0238.042] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0238.042] CloseHandle (hObject=0x500) returned 1 [0238.042] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0238.042] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0238.042] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a320 [0238.042] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0238.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0238.043] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19d80 [0238.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f88 [0238.043] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0238.043] GetLastError () returned 0x0 [0238.043] SetLastError (dwErrCode=0x0) [0238.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0238.043] GetLastError () returned 0x0 [0238.043] SetLastError (dwErrCode=0x0) [0238.043] GetLastError () returned 0x0 [0238.043] SetLastError (dwErrCode=0x0) [0238.043] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] GetLastError () returned 0x0 [0238.044] SetLastError (dwErrCode=0x0) [0238.044] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7a0 [0238.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.045] GetLastError () returned 0x0 [0238.045] SetLastError (dwErrCode=0x0) [0238.045] GetLastError () returned 0x0 [0238.045] SetLastError (dwErrCode=0x0) [0238.045] GetLastError () returned 0x0 [0238.045] SetLastError (dwErrCode=0x0) [0238.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0238.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0238.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0238.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VMExNofJE4VFz9a2IHu", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VMExNofJE4VFz9a2IHu", lpUsedDefaultChar=0x0) returned 19 [0238.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0238.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0238.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0238.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0238.045] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0238.045] WriteFile (in: hFile=0x500, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe66, lpOverlapped=0x0) returned 1 [0238.046] CloseHandle (hObject=0x500) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f88 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19d80 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0238.046] CryptDestroyKey (hKey=0x5260f08) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0238.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39c88 | out: hHeap=0x310000) returned 1 [0238.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572068 | out: hHeap=0x310000) returned 1 [0238.047] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0238.047] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0238.047] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.047] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0238.395] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.396] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0238.396] CloseHandle (hObject=0x500) returned 1 [0238.396] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0238.396] RmStartSession () returned 0x0 [0238.560] RmRegisterResources () returned 0x0 [0238.560] RmGetList () returned 0x0 [0238.650] RmShutdown () returned 0x0 [0238.685] RmEndSession () returned 0x0 [0238.686] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260b88) returned 1 [0238.686] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0238.686] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties", dwFileAttributes=0x20) returned 1 [0238.687] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0238.687] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0238.687] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=2860) returned 1 [0238.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5efb0 [0238.687] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5809020 [0239.138] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0239.138] ReadFile (in: hFile=0x550, lpBuffer=0x5809040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x5809040*, lpNumberOfBytesRead=0x3a2f678*=0xb2c, lpOverlapped=0x0) returned 1 [0239.139] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0239.139] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5efc0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5efc0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0239.139] WriteFile (in: hFile=0x550, lpBuffer=0x4b5efc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b5efc0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0239.140] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0239.140] WriteFile (in: hFile=0x550, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0239.140] WriteFile (in: hFile=0x550, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0239.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5809020 | out: hHeap=0x310000) returned 1 [0240.632] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5efb0 | out: hHeap=0x310000) returned 1 [0240.632] CloseHandle (hObject=0x550) returned 1 [0240.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0240.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0240.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0240.632] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0240.633] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0240.633] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0240.633] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0240.633] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0240.633] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0240.633] GetLastError () returned 0x0 [0240.633] SetLastError (dwErrCode=0x0) [0240.633] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0240.633] GetLastError () returned 0x0 [0240.633] SetLastError (dwErrCode=0x0) [0240.633] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] SetLastError (dwErrCode=0x0) [0240.634] GetLastError () returned 0x0 [0240.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i6wA2DFQuIvsE0M68KGbjpjLz", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0240.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0240.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i6wA2DFQuIvsE0M68KGbjpjLz", cchWideChar=25, lpMultiByteStr=0x38c160, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i6wA2DFQuIvsE0M68KGbjpjLz", lpUsedDefaultChar=0x0) returned 25 [0240.634] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e60b0 | out: hHeap=0x310000) returned 1 [0240.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0240.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0240.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0240.634] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0240.635] WriteFile (in: hFile=0x550, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6c, lpOverlapped=0x0) returned 1 [0240.639] CloseHandle (hObject=0x550) returned 1 [0240.639] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0240.640] CryptDestroyKey (hKey=0x5260b88) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55705a0 | out: hHeap=0x310000) returned 1 [0240.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572478 | out: hHeap=0x310000) returned 1 [0240.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0240.640] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0240.640] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.640] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0240.666] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.666] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0240.666] CloseHandle (hObject=0x550) returned 1 [0240.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0240.666] RmStartSession () returned 0x0 [0240.667] RmRegisterResources () returned 0x0 [0240.668] RmGetList () returned 0x0 [0241.080] RmShutdown () returned 0x0 [0243.116] RmEndSession () returned 0x0 [0243.117] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261048) returned 1 [0243.117] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0243.117] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif", dwFileAttributes=0x20) returned 1 [0243.117] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0243.117] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0243.117] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=8590) returned 1 [0243.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0243.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e6020 [0243.135] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0243.135] ReadFile (in: hFile=0x550, lpBuffer=0x49e6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x49e6040*, lpNumberOfBytesRead=0x3a2f678*=0x218e, lpOverlapped=0x0) returned 1 [0243.272] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0243.272] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0243.272] WriteFile (in: hFile=0x550, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0243.272] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0243.272] WriteFile (in: hFile=0x550, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0243.272] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0243.272] WriteFile (in: hFile=0x550, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0243.273] WriteFile (in: hFile=0x550, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0243.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e6020 | out: hHeap=0x310000) returned 1 [0243.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0243.278] CloseHandle (hObject=0x550) returned 1 [0243.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0243.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0243.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0243.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0243.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0243.278] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0243.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0243.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0243.279] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0243.279] GetLastError () returned 0x0 [0243.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0243.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x3a2f4b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HTk", lpUsedDefaultChar=0x0) returned 3 [0243.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0243.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0243.280] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0243.280] WriteFile (in: hFile=0x550, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe56, lpOverlapped=0x0) returned 1 [0243.281] CloseHandle (hObject=0x550) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0243.281] CryptDestroyKey (hKey=0x5261048) returned 1 [0243.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0243.282] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3b38 | out: hHeap=0x310000) returned 1 [0243.282] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44e98 | out: hHeap=0x310000) returned 1 [0243.282] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0243.282] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0243.282] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.282] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0243.319] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.319] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0243.319] CloseHandle (hObject=0x550) returned 1 [0243.319] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0243.319] RmStartSession () returned 0x0 [0243.321] RmRegisterResources () returned 0x0 [0243.321] RmGetList () returned 0x0 [0245.654] RmShutdown () returned 0x0 [0246.422] RmEndSession () returned 0x0 [0246.423] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260c08) returned 1 [0246.423] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0246.423] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar", dwFileAttributes=0x20) returned 1 [0246.423] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0246.423] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0246.423] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=32699) returned 1 [0246.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0246.424] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7a2d020 [0246.837] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0246.837] GetLastError () returned 0x0 [0246.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0246.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0246.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cxggr6GZHburIVpq", cchWideChar=16, lpMultiByteStr=0x38c4d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cxggr6GZHburIVpq", lpUsedDefaultChar=0x0) returned 16 [0246.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0246.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0246.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0246.837] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0246.837] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0246.838] WriteFile (in: hFile=0x550, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe63, lpOverlapped=0x0) returned 1 [0246.839] CloseHandle (hObject=0x550) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0246.839] CryptDestroyKey (hKey=0x5260c08) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0246.839] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53522e0 | out: hHeap=0x310000) returned 1 [0246.839] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0246.840] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0246.840] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.840] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0246.841] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.841] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0246.841] CloseHandle (hObject=0x550) returned 1 [0246.841] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0246.841] RmStartSession () returned 0x0 [0246.843] RmRegisterResources () returned 0x0 [0246.847] RmGetList () returned 0x0 [0247.345] RmShutdown () returned 0x0 [0247.383] RmEndSession () returned 0x0 [0247.385] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261188) returned 1 [0247.385] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0247.385] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif", dwFileAttributes=0x20) returned 1 [0247.385] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0247.385] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0247.385] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=153) returned 1 [0247.385] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6e068 [0247.385] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58db020 [0248.139] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0248.140] GetLastError () returned 0x0 [0248.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0248.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0248.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="35nXCJ3t7DcPBvTOWYb", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="35nXCJ3t7DcPBvTOWYb", lpUsedDefaultChar=0x0) returned 19 [0248.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b848 | out: hHeap=0x310000) returned 1 [0248.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0248.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0248.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0248.140] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0248.141] WriteFile (in: hFile=0x550, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe66, lpOverlapped=0x0) returned 1 [0248.141] CloseHandle (hObject=0x550) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0248.142] CryptDestroyKey (hKey=0x5261188) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55702a8 | out: hHeap=0x310000) returned 1 [0248.142] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352290 | out: hHeap=0x310000) returned 1 [0248.142] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0248.142] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0248.142] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.142] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0248.143] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.143] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0248.143] CloseHandle (hObject=0x550) returned 1 [0248.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc380 [0248.143] RmStartSession () returned 0x0 [0248.144] RmRegisterResources () returned 0x0 [0248.145] RmGetList () returned 0x0 [0248.242] RmShutdown () returned 0x0 [0249.158] RmEndSession () returned 0x0 [0249.411] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260f88) returned 1 [0249.411] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0249.411] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", dwFileAttributes=0x20) returned 1 [0249.411] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0249.411] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0249.411] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=153) returned 1 [0249.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0249.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e4020 [0249.502] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0249.502] GetLastError () returned 0x0 [0249.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0249.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PiOtXVpgTpKUXLbQBZW9tL", cchWideChar=22, lpMultiByteStr=0x38c4d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PiOtXVpgTpKUXLbQBZW9tL", lpUsedDefaultChar=0x0) returned 22 [0249.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b688 | out: hHeap=0x310000) returned 1 [0249.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0249.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0249.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0249.503] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0249.503] WriteFile (in: hFile=0x550, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe69, lpOverlapped=0x0) returned 1 [0249.504] CloseHandle (hObject=0x550) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d199c0 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f9b90 | out: hHeap=0x310000) returned 1 [0249.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0249.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0249.505] CryptDestroyKey (hKey=0x5260f88) returned 1 [0249.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0249.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcc20 | out: hHeap=0x310000) returned 1 [0249.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352ba0 | out: hHeap=0x310000) returned 1 [0249.505] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0249.505] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0249.505] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.505] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0249.511] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.511] ReadFile (in: hFile=0x550, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0249.511] CloseHandle (hObject=0x550) returned 1 [0249.511] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a230 [0249.511] RmStartSession () returned 0x0 [0249.893] RmRegisterResources () returned 0x0 [0249.893] RmGetList () returned 0x0 [0249.979] RmShutdown () returned 0x0 [0250.613] RmEndSession () returned 0x0 [0250.614] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260c08) returned 1 [0250.614] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0250.614] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", dwFileAttributes=0x20) returned 1 [0250.614] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0250.614] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0250.614] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=584576) returned 1 [0250.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0250.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f2020 [0251.080] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0251.080] ReadFile (in: hFile=0x5c0, lpBuffer=0x56f2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x56f2040*, lpNumberOfBytesRead=0x3a2f678*=0x8eb80, lpOverlapped=0x0) returned 1 [0251.085] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0251.085] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.085] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.086] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.086] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.087] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.087] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.088] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.088] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.088] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.088] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.088] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.088] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.088] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.088] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.088] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.088] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.089] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.089] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.090] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.090] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.091] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.091] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.092] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.092] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.093] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.093] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.094] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.094] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.095] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7c120*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0251.095] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d7c120*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d7c120*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0251.096] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0251.096] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0251.096] WriteFile (in: hFile=0x5c0, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0251.096] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f2020 | out: hHeap=0x310000) returned 1 [0251.557] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d7c100 | out: hHeap=0x310000) returned 1 [0251.557] CloseHandle (hObject=0x5c0) returned 1 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a488 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0251.558] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0251.558] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ee8 [0251.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0251.558] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0251.559] GetLastError () returned 0x0 [0251.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0251.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c4d0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.559] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f2a10 | out: hHeap=0x310000) returned 1 [0251.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0251.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0251.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0251.559] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0251.560] WriteFile (in: hFile=0x5c0, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe70, lpOverlapped=0x0) returned 1 [0251.561] CloseHandle (hObject=0x5c0) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ee8 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0251.561] CryptDestroyKey (hKey=0x5260c08) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a230 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a1b0 | out: hHeap=0x310000) returned 1 [0251.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352e20 | out: hHeap=0x310000) returned 1 [0251.561] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0251.561] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0251.561] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.562] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0251.566] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.566] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0251.566] CloseHandle (hObject=0x5c0) returned 1 [0251.566] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0251.566] RmStartSession () returned 0x0 [0251.569] RmRegisterResources () returned 0x0 [0251.569] RmGetList () returned 0x0 [0251.604] RmShutdown () returned 0x0 [0255.327] RmEndSession () returned 0x0 [0255.328] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260e48) returned 1 [0255.328] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0255.328] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties", dwFileAttributes=0x20) returned 1 [0255.328] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0255.328] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0255.328] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=10393) returned 1 [0255.328] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0255.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f7020 [0255.347] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0255.347] ReadFile (in: hFile=0x5c0, lpBuffer=0x56f7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x56f7040*, lpNumberOfBytesRead=0x3a2f678*=0x2899, lpOverlapped=0x0) returned 1 [0255.349] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0255.349] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d60020*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d60020*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0255.349] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d60020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d60020*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0255.350] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d60020*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d60020*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0255.350] WriteFile (in: hFile=0x5c0, lpBuffer=0x5d60020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5d60020*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0255.350] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0255.350] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0255.350] WriteFile (in: hFile=0x5c0, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0255.350] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f7020 | out: hHeap=0x310000) returned 1 [0255.355] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d60010 | out: hHeap=0x310000) returned 1 [0255.355] CloseHandle (hObject=0x5c0) returned 1 [0255.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0255.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0255.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0255.355] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0255.355] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0255.355] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0255.356] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0255.356] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0255.356] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0255.356] GetLastError () returned 0x0 [0255.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0255.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x3a2f4b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx231C421W", lpUsedDefaultChar=0x0) returned 10 [0255.357] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0255.357] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0255.357] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0255.357] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0255.358] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe5d, lpOverlapped=0x0) returned 1 [0255.359] CloseHandle (hObject=0x5c0) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0255.359] CryptDestroyKey (hKey=0x5260e48) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2f88 | out: hHeap=0x310000) returned 1 [0255.359] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353370 | out: hHeap=0x310000) returned 1 [0255.359] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0255.359] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0255.360] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.360] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0255.830] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.830] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0255.830] CloseHandle (hObject=0x5c0) returned 1 [0255.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392128 [0255.831] RmStartSession () returned 0x0 [0256.147] RmRegisterResources () returned 0x0 [0256.147] RmGetList () returned 0x0 [0256.375] RmShutdown () returned 0x0 [0257.147] RmEndSession () returned 0x0 [0257.147] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261688) returned 1 [0257.147] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0257.148] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\README.txt", dwFileAttributes=0x20) returned 1 [0257.148] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0257.148] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0257.148] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=46) returned 1 [0257.148] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bae030 [0257.148] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56fc020 [0258.031] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0258.031] GetLastError () returned 0x0 [0258.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0258.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x38c390, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Jqd1nQTWMi6MgqEEJIg", lpUsedDefaultChar=0x0) returned 20 [0258.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0258.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0258.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0258.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0258.032] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0258.033] WriteFile (in: hFile=0x5c0, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe67, lpOverlapped=0x0) returned 1 [0258.034] CloseHandle (hObject=0x5c0) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0258.034] CryptDestroyKey (hKey=0x5261688) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a24b0 | out: hHeap=0x310000) returned 1 [0258.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351840 | out: hHeap=0x310000) returned 1 [0258.034] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0258.034] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0258.034] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.034] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0258.036] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.036] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0258.036] CloseHandle (hObject=0x5c0) returned 1 [0258.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09af0 [0258.036] RmStartSession () returned 0x0 [0258.037] RmRegisterResources () returned 0x0 [0258.041] RmGetList () returned 0x0 [0258.818] RmShutdown () returned 0x0 [0259.817] RmEndSession () returned 0x0 [0259.818] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261548) returned 1 [0259.818] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0259.818] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0259.818] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0259.818] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0259.818] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=1261) returned 1 [0259.818] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c8f270 [0259.819] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7afd020 [0260.703] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0260.703] GetLastError () returned 0x0 [0260.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0260.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0260.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c098, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0260.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61181e0 | out: hHeap=0x310000) returned 1 [0260.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0260.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e7eb0 [0260.703] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0260.703] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0260.704] WriteFile (in: hFile=0x5c0, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe71, lpOverlapped=0x0) returned 1 [0260.705] CloseHandle (hObject=0x5c0) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04138 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539fb08 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f058c8 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0260.705] CryptDestroyKey (hKey=0x5261548) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09af0 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa110 | out: hHeap=0x310000) returned 1 [0260.705] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351bb0 | out: hHeap=0x310000) returned 1 [0260.705] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0260.705] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0260.706] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.706] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0260.707] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.707] ReadFile (in: hFile=0x5c0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0260.707] CloseHandle (hObject=0x5c0) returned 1 [0260.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09af0 [0260.708] RmStartSession () returned 0x0 [0261.055] RmRegisterResources () returned 0x0 [0261.055] RmGetList () returned 0x0 [0261.205] RmShutdown () returned 0x0 [0261.629] RmEndSession () returned 0x0 [0261.727] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260e08) returned 1 [0261.727] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0261.727] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0261.727] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0261.727] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0261.727] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=2147) returned 1 [0261.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c72020 [0261.728] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6216020 [0261.752] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0261.752] GetLastError () returned 0x0 [0261.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0261.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x3a2f4b0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3", lpUsedDefaultChar=0x0) returned 1 [0261.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0261.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0261.753] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0261.754] WriteFile (in: hFile=0x56c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe54, lpOverlapped=0x0) returned 1 [0261.754] CloseHandle (hObject=0x56c) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04d00 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f348 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b0b0 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0261.755] CryptDestroyKey (hKey=0x5260e08) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09af0 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba9ab8 | out: hHeap=0x310000) returned 1 [0261.755] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351d90 | out: hHeap=0x310000) returned 1 [0261.755] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0261.755] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0261.755] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.755] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0261.798] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.798] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0261.799] CloseHandle (hObject=0x56c) returned 1 [0261.799] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f09af0 [0261.799] RmStartSession () returned 0x0 [0261.801] RmRegisterResources () returned 0x0 [0263.069] RmGetList () returned 0x0 [0263.996] RmShutdown () returned 0x0 [0264.635] RmEndSession () returned 0x0 [0264.636] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261a08) returned 1 [0264.636] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0264.636] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.636] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0264.636] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0264.636] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=1261) returned 1 [0264.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x675c068 [0264.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5621020 [0266.591] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0266.591] GetLastError () returned 0x0 [0266.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x3a2f4b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.591] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0266.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0266.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0266.591] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0266.591] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.592] WriteFile (in: hFile=0x680, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe61, lpOverlapped=0x0) returned 1 [0266.593] CloseHandle (hObject=0x680) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4c80 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539f440 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4e50 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0266.593] CryptDestroyKey (hKey=0x5261a08) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f09af0 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348f18 | out: hHeap=0x310000) returned 1 [0266.593] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19920 | out: hHeap=0x310000) returned 1 [0266.593] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0266.593] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.593] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.593] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0266.595] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.595] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0266.595] CloseHandle (hObject=0x680) returned 1 [0266.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0266.595] RmStartSession () returned 0x0 [0266.762] RmRegisterResources () returned 0x0 [0266.762] RmGetList () returned 0x0 [0266.875] RmShutdown () returned 0x0 [0268.527] RmEndSession () returned 0x0 [0268.529] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260e08) returned 1 [0268.529] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0268.529] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml", dwFileAttributes=0x220) returned 1 [0268.529] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0268.529] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0268.529] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=9831) returned 1 [0268.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0268.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b04020 [0268.903] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0268.903] GetLastError () returned 0x0 [0268.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0268.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0268.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x38c3b8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1f15BUaqm7XqtONc8btxaBe3", lpUsedDefaultChar=0x0) returned 24 [0268.904] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e87a70 | out: hHeap=0x310000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0268.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0268.904] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0268.904] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0268.905] WriteFile (in: hFile=0x4fc, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6b, lpOverlapped=0x0) returned 1 [0268.905] CloseHandle (hObject=0x4fc) returned 1 [0268.905] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0360 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53f7610 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0268.906] CryptDestroyKey (hKey=0x5260e08) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efc38 | out: hHeap=0x310000) returned 1 [0268.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18d90 | out: hHeap=0x310000) returned 1 [0268.906] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0268.906] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0268.907] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.907] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0268.909] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.909] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0268.909] CloseHandle (hObject=0x4fc) returned 1 [0268.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0268.909] RmStartSession () returned 0x0 [0268.910] RmRegisterResources () returned 0x0 [0268.911] RmGetList () returned 0x0 [0268.995] RmShutdown () returned 0x0 [0270.608] RmEndSession () returned 0x0 [0270.609] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260f88) returned 1 [0270.609] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0270.609] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF", dwFileAttributes=0x220) returned 1 [0270.609] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0270.610] CryptEncrypt (in: hKey=0x5260f88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0270.610] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=12482) returned 1 [0270.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0270.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78dc020 [0272.489] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0272.489] GetLastError () returned 0x0 [0272.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0272.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x3a2f4b0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bY", lpUsedDefaultChar=0x0) returned 2 [0272.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0272.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0272.489] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0272.490] WriteFile (in: hFile=0x4fc, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe55, lpOverlapped=0x0) returned 1 [0272.491] CloseHandle (hObject=0x4fc) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ebb00 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0272.491] CryptDestroyKey (hKey=0x5260f88) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a50a8 | out: hHeap=0x310000) returned 1 [0272.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2f50 | out: hHeap=0x310000) returned 1 [0272.491] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0272.491] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0272.492] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.492] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0272.530] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.531] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0272.531] CloseHandle (hObject=0x4fc) returned 1 [0272.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0272.531] RmStartSession () returned 0x0 [0272.532] RmRegisterResources () returned 0x0 [0272.536] RmGetList () returned 0x0 [0275.872] RmShutdown () returned 0x0 [0277.288] RmEndSession () returned 0x0 [0277.289] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261588) returned 1 [0277.289] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0277.289] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF", dwFileAttributes=0x220) returned 1 [0277.289] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0277.289] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0277.289] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=3966) returned 1 [0277.289] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0277.290] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf1020 [0278.160] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0278.160] ReadFile (in: hFile=0x4fc, lpBuffer=0x4cf1040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x4cf1040*, lpNumberOfBytesRead=0x3a2f678*=0xf7e, lpOverlapped=0x0) returned 1 [0278.161] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0278.161] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0278.161] WriteFile (in: hFile=0x4fc, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0278.161] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0278.161] WriteFile (in: hFile=0x4fc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0278.161] WriteFile (in: hFile=0x4fc, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0278.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf1020 | out: hHeap=0x310000) returned 1 [0279.220] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0279.220] CloseHandle (hObject=0x4fc) returned 1 [0279.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0279.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0279.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a48f0 [0279.220] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0279.220] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0279.220] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0279.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5010 [0279.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0279.222] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0279.222] GetLastError () returned 0x0 [0279.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0279.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0279.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5PaBVzxQBGd15AjyqsacvL0n", cchWideChar=24, lpMultiByteStr=0x38c4d0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5PaBVzxQBGd15AjyqsacvL0n", lpUsedDefaultChar=0x0) returned 24 [0279.222] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7bae0 | out: hHeap=0x310000) returned 1 [0279.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0279.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0279.223] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0279.223] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0279.224] WriteFile (in: hFile=0x4fc, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6b, lpOverlapped=0x0) returned 1 [0279.225] CloseHandle (hObject=0x4fc) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5010 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a48f0 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0279.225] CryptDestroyKey (hKey=0x5261588) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5db8 | out: hHeap=0x310000) returned 1 [0279.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3590 | out: hHeap=0x310000) returned 1 [0279.225] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0279.225] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0279.226] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.226] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0279.227] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0279.227] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0279.227] CloseHandle (hObject=0x4fc) returned 1 [0279.227] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b32e0 [0279.227] RmStartSession () returned 0x0 [0279.229] RmRegisterResources () returned 0x0 [0279.230] RmGetList () returned 0x0 [0279.252] RmShutdown () returned 0x0 [0280.006] RmEndSession () returned 0x0 [0280.006] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261588) returned 1 [0280.006] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0280.006] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF", dwFileAttributes=0x220) returned 1 [0280.007] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0280.007] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0280.007] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=7804) returned 1 [0280.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0280.007] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf8020 [0280.489] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0280.490] ReadFile (in: hFile=0x4fc, lpBuffer=0x4cf8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x4cf8040*, lpNumberOfBytesRead=0x3a2f678*=0x1e7c, lpOverlapped=0x0) returned 1 [0280.496] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0280.496] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0280.496] WriteFile (in: hFile=0x4fc, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0280.497] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0280.497] WriteFile (in: hFile=0x4fc, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0280.497] WriteFile (in: hFile=0x4fc, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0280.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf8020 | out: hHeap=0x310000) returned 1 [0280.558] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0280.558] CloseHandle (hObject=0x4fc) returned 1 [0280.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0280.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0280.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0280.558] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.558] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0280.559] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0280.559] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0280.559] GetLastError () returned 0x0 [0280.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0280.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c1b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e80810 | out: hHeap=0x310000) returned 1 [0280.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0280.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0280.560] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.560] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0280.561] WriteFile (in: hFile=0x4fc, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6f, lpOverlapped=0x0) returned 1 [0280.561] CloseHandle (hObject=0x4fc) returned 1 [0280.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.561] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0280.562] CryptDestroyKey (hKey=0x5261588) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94340 | out: hHeap=0x310000) returned 1 [0280.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1b00 | out: hHeap=0x310000) returned 1 [0280.562] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0280.562] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0280.562] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.562] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0280.564] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.564] ReadFile (in: hFile=0x4fc, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0280.564] CloseHandle (hObject=0x4fc) returned 1 [0280.564] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0280.564] RmStartSession () returned 0x0 [0280.671] RmRegisterResources () returned 0x0 [0280.671] RmGetList () returned 0x0 [0280.747] RmShutdown () returned 0x0 [0282.505] RmEndSession () returned 0x0 [0282.506] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5261848) returned 1 [0282.506] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0282.506] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF", dwFileAttributes=0x220) returned 1 [0282.506] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0282.506] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0282.506] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=4296) returned 1 [0282.506] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0282.507] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7a2b020 [0283.131] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0283.131] ReadFile (in: hFile=0x500, lpBuffer=0x7a2b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x7a2b040*, lpNumberOfBytesRead=0x3a2f678*=0x10c8, lpOverlapped=0x0) returned 1 [0283.133] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0283.133] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0283.133] WriteFile (in: hFile=0x500, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0283.133] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0283.133] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0283.134] WriteFile (in: hFile=0x500, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0283.134] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7a2b020 | out: hHeap=0x310000) returned 1 [0284.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0284.425] CloseHandle (hObject=0x500) returned 1 [0284.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0284.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0284.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0284.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0284.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0284.425] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0284.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0284.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0284.426] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0284.426] GetLastError () returned 0x0 [0284.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0284.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x3a2f4b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sW6xAztyt", lpUsedDefaultChar=0x0) returned 9 [0284.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0284.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0284.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0284.427] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0284.427] WriteFile (in: hFile=0x500, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe5c, lpOverlapped=0x0) returned 1 [0284.428] CloseHandle (hObject=0x500) returned 1 [0284.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0284.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0284.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0284.429] CryptDestroyKey (hKey=0x5261848) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c950e8 | out: hHeap=0x310000) returned 1 [0284.429] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1ec0 | out: hHeap=0x310000) returned 1 [0284.429] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0284.429] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0284.429] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.429] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0284.431] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.431] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0284.431] CloseHandle (hObject=0x500) returned 1 [0284.431] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0284.431] RmStartSession () returned 0x0 [0284.434] RmRegisterResources () returned 0x0 [0284.438] RmGetList () returned 0x0 [0285.598] RmShutdown () returned 0x0 [0286.600] RmEndSession () returned 0x0 [0286.601] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x5260c08) returned 1 [0286.602] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0286.602] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x220) returned 1 [0286.602] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0286.602] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0286.602] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=4924) returned 1 [0286.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0286.602] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f3020 [0287.199] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0287.199] ReadFile (in: hFile=0x500, lpBuffer=0x76f3040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x76f3040*, lpNumberOfBytesRead=0x3a2f678*=0x133c, lpOverlapped=0x0) returned 1 [0287.235] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0287.236] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0287.236] WriteFile (in: hFile=0x500, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0287.236] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0287.236] WriteFile (in: hFile=0x500, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0287.236] WriteFile (in: hFile=0x500, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0287.236] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f3020 | out: hHeap=0x310000) returned 1 [0289.869] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0289.869] CloseHandle (hObject=0x500) returned 1 [0289.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0289.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3fe0 [0289.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5568 [0289.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4208 [0289.869] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3fe0 | out: hHeap=0x310000) returned 1 [0289.869] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5308 [0289.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.870] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0289.871] GetLastError () returned 0x0 [0289.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0289.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0289.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c548, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0289.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e0a0 | out: hHeap=0x310000) returned 1 [0289.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0289.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0289.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.871] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0289.872] WriteFile (in: hFile=0x500, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe6f, lpOverlapped=0x0) returned 1 [0289.873] CloseHandle (hObject=0x500) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5308 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4208 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5568 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0289.873] CryptDestroyKey (hKey=0x5260c08) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94fb8 | out: hHeap=0x310000) returned 1 [0289.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2a50 | out: hHeap=0x310000) returned 1 [0289.873] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0289.873] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0289.874] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.874] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0289.875] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.875] ReadFile (in: hFile=0x500, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0289.875] CloseHandle (hObject=0x500) returned 1 [0289.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5990 [0289.875] RmStartSession () returned 0x0 [0290.323] RmRegisterResources () returned 0x0 [0290.323] RmGetList () returned 0x0 [0291.718] RmShutdown () returned 0x0 [0292.462] RmEndSession () returned 0x0 [0292.688] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3a2f778 | out: phKey=0x3a2f778*=0x35d908) returned 1 [0292.688] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0292.688] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF", dwFileAttributes=0x220) returned 1 [0292.688] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0292.688] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3a2f5d8*=0x2000) returned 1 [0292.688] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3a2f670 | out: lpFileSize=0x3a2f670*=880) returned 1 [0292.689] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0292.689] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c21020 [0292.707] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0292.707] ReadFile (in: hFile=0x584, lpBuffer=0x4c21040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3a2f678, lpOverlapped=0x0 | out: lpBuffer=0x4c21040*, lpNumberOfBytesRead=0x3a2f678*=0x370, lpOverlapped=0x0) returned 1 [0292.707] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f660 | out: lpNewFilePointer=0x0) returned 1 [0292.707] CryptEncrypt (in: hKey=0x35d908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3a2f5ec*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3a2f5ec*=0x2000) returned 1 [0292.708] WriteFile (in: hFile=0x584, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3a2f67c*=0x2000, lpOverlapped=0x0) returned 1 [0292.708] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2f668 | out: lpNewFilePointer=0x0) returned 1 [0292.708] WriteFile (in: hFile=0x584, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3a2f67c*=0x200, lpOverlapped=0x0) returned 1 [0292.708] WriteFile (in: hFile=0x584, lpBuffer=0x3a2f618*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x3a2f618*, lpNumberOfBytesWritten=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0292.708] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c21020 | out: hHeap=0x310000) returned 1 [0293.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0295.736] CloseHandle (hObject=0x584) returned 1 [0295.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0295.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf520 [0295.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95e90 [0295.737] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf690 [0295.737] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf520 | out: hHeap=0x310000) returned 1 [0295.737] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95938 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0295.738] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3a2f44c | out: lpSystemTimeAsFileTime=0x3a2f44c) [0295.738] GetLastError () returned 0x0 [0295.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0295.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x38c098, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e0sG9NpfUiifqv54", lpUsedDefaultChar=0x0) returned 16 [0295.738] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0295.738] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0295.738] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0295.739] WriteFile (in: hFile=0x584, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3a2f5ec, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3a2f5ec*=0xe63, lpOverlapped=0x0) returned 1 [0295.740] CloseHandle (hObject=0x584) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95938 | out: hHeap=0x310000) returned 1 [0295.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf690 | out: hHeap=0x310000) returned 1 [0295.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95e90 | out: hHeap=0x310000) returned 1 [0295.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0295.741] CryptDestroyKey (hKey=0x35d908) returned 1 [0295.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5990 | out: hHeap=0x310000) returned 1 [0295.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c958a0 | out: hHeap=0x310000) returned 1 [0295.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a1c8 | out: hHeap=0x310000) returned 1 [0295.741] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3a2f7ac, lpCompletionKey=0x3a2f7b0, lpOverlapped=0x3a2f7a8) returned 1 [0295.741] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0295.741] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f680 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.741] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f67c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f67c*=0x18, lpOverlapped=0x0) returned 1 [0295.742] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2f688 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.742] ReadFile (in: hFile=0x584, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3a2f670, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3a2f670*=0x18, lpOverlapped=0x0) returned 1 [0295.743] CloseHandle (hObject=0x584) returned 1 [0295.743] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95e90 [0295.743] RmStartSession () returned 0x0 [0295.761] RmRegisterResources () returned 0x0 [0295.761] RmGetList () returned 0x0 [0295.903] RmShutdown () Thread: id = 15 os_tid = 0x10fc [0068.625] GetLastError () returned 0x57 [0068.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x355830 [0068.625] SetLastError (dwErrCode=0x57) [0068.626] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0080.294] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0081.325] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0085.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0092.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0098.980] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0100.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0107.627] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0108.721] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0124.544] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0127.651] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0135.316] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0136.072] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.072] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.538] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0136.539] CloseHandle (hObject=0x5b0) returned 1 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060288 [0136.539] RmStartSession () returned 0x0 [0137.920] RmRegisterResources () returned 0x0 [0138.355] RmGetList () returned 0x0 [0140.584] RmShutdown () returned 0x0 [0142.979] RmEndSession () returned 0x0 [0142.980] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261708) returned 1 [0142.980] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0142.980] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0142.980] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0142.981] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0142.981] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=60816) returned 1 [0142.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5df4048 [0142.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6968020 [0143.500] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0143.500] ReadFile (in: hFile=0x650, lpBuffer=0x6968040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6968040*, lpNumberOfBytesRead=0x3b6fc40*=0xed90, lpOverlapped=0x0) returned 1 [0143.502] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.503] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.503] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.504] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.504] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.504] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5df4060*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0143.504] WriteFile (in: hFile=0x650, lpBuffer=0x5df4060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5df4060*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0143.504] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0143.504] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0143.504] WriteFile (in: hFile=0x650, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0143.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6968020 | out: hHeap=0x310000) returned 1 [0144.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5df4048 | out: hHeap=0x310000) returned 1 [0144.260] CloseHandle (hObject=0x650) returned 1 [0144.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0144.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0144.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0144.263] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaf18 [0144.263] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0144.263] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1028\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0144.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0144.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0144.264] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0144.265] GetLastError () returned 0x0 [0144.265] SetLastError (dwErrCode=0x0) [0144.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea830 [0144.265] GetLastError () returned 0x0 [0144.265] SetLastError (dwErrCode=0x0) [0144.265] GetLastError () returned 0x0 [0144.265] SetLastError (dwErrCode=0x0) [0144.265] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea830 | out: hHeap=0x310000) returned 1 [0144.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0144.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x3b6fa70, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1", lpUsedDefaultChar=0x0) returned 1 [0144.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0144.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5364f50 [0144.265] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1028\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0144.266] WriteFile (in: hFile=0x650, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe54, lpOverlapped=0x0) returned 1 [0144.267] CloseHandle (hObject=0x650) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5364f50 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0144.269] CryptDestroyKey (hKey=0x5261708) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060288 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391cb0 | out: hHeap=0x310000) returned 1 [0144.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365c28 | out: hHeap=0x310000) returned 1 [0144.269] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0144.269] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0144.270] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.270] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0144.339] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.339] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0144.339] CloseHandle (hObject=0x650) returned 1 [0144.339] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0144.339] RmStartSession () returned 0x0 [0144.560] RmRegisterResources () returned 0x0 [0144.564] RmGetList () returned 0x0 [0144.882] RmShutdown () returned 0x0 [0148.955] RmEndSession () returned 0x0 [0148.956] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52614c8) returned 1 [0148.956] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0148.956] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0148.956] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0148.956] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0148.956] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=79634) returned 1 [0148.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb4560 [0148.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6b3a020 [0148.975] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0148.976] ReadFile (in: hFile=0x650, lpBuffer=0x6b3a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6b3a040*, lpNumberOfBytesRead=0x3b6fc40*=0x13712, lpOverlapped=0x0) returned 1 [0149.004] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0149.004] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.004] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.004] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.004] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.004] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.004] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.005] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb4580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0149.005] WriteFile (in: hFile=0x650, lpBuffer=0x4bb4580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb4580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0149.006] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0149.006] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0149.006] WriteFile (in: hFile=0x650, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0149.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b3a020 | out: hHeap=0x310000) returned 1 [0149.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb4560 | out: hHeap=0x310000) returned 1 [0149.011] CloseHandle (hObject=0x650) returned 1 [0149.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0149.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a31a8 [0149.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0149.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3670 [0149.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a31a8 | out: hHeap=0x310000) returned 1 [0149.015] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1043\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0149.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0149.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b10 [0149.016] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0149.016] GetLastError () returned 0x0 [0149.016] SetLastError (dwErrCode=0x0) [0149.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2f88 [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.271] GetLastError () returned 0x0 [0149.271] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0149.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0149.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2f88 | out: hHeap=0x310000) returned 1 [0149.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0149.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x38c1b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JuH0I4bPusHDEdIv", lpUsedDefaultChar=0x0) returned 16 [0149.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0149.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0149.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0149.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c397d8 [0149.273] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1043\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0149.275] WriteFile (in: hFile=0x5d4, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe63, lpOverlapped=0x0) returned 1 [0149.276] CloseHandle (hObject=0x5d4) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c397d8 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3670 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0149.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0149.277] CryptDestroyKey (hKey=0x52614c8) returned 1 [0150.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0150.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0150.498] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c192e0 | out: hHeap=0x310000) returned 1 [0150.498] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0150.498] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0150.500] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.500] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0150.537] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.538] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0150.538] CloseHandle (hObject=0x52c) returned 1 [0150.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0150.538] RmStartSession () returned 0x0 [0150.660] RmRegisterResources () returned 0x0 [0150.663] RmGetList () returned 0x0 [0151.954] RmShutdown () returned 0x0 [0153.584] RmEndSession () returned 0x0 [0153.975] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261588) returned 1 [0153.976] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0153.976] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico", dwFileAttributes=0x80) returned 1 [0153.976] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0153.976] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0153.976] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=1150) returned 1 [0153.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0153.976] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621b020 [0153.994] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0153.994] ReadFile (in: hFile=0x634, lpBuffer=0x621b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x621b040*, lpNumberOfBytesRead=0x3b6fc40*=0x47e, lpOverlapped=0x0) returned 1 [0154.079] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0154.079] CryptEncrypt (in: hKey=0x5261588, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0154.079] WriteFile (in: hFile=0x634, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0154.079] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0154.079] WriteFile (in: hFile=0x634, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0154.080] WriteFile (in: hFile=0x634, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0154.080] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x621b020 | out: hHeap=0x310000) returned 1 [0154.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0154.085] CloseHandle (hObject=0x634) returned 1 [0154.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0154.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0b58 [0154.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0154.086] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0154.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0154.086] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0154.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0154.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0154.087] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0154.087] GetLastError () returned 0x0 [0154.087] SetLastError (dwErrCode=0x0) [0154.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0154.087] GetLastError () returned 0x0 [0154.087] SetLastError (dwErrCode=0x0) [0154.087] GetLastError () returned 0x0 [0154.087] SetLastError (dwErrCode=0x0) [0154.087] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0154.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0154.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x3b6fa70, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0154.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0154.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0154.087] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0154.088] WriteFile (in: hFile=0x634, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe54, lpOverlapped=0x0) returned 1 [0154.089] CloseHandle (hObject=0x634) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0154.090] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0154.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0154.091] CryptDestroyKey (hKey=0x5261588) returned 1 [0154.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0154.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060970 | out: hHeap=0x310000) returned 1 [0154.091] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3652c8 | out: hHeap=0x310000) returned 1 [0154.091] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0154.091] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0154.091] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.091] ReadFile (in: hFile=0x634, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0154.318] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.318] ReadFile (in: hFile=0x634, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0154.318] CloseHandle (hObject=0x634) returned 1 [0154.318] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3997c8 [0154.318] RmStartSession () returned 0x0 [0155.118] RmRegisterResources () returned 0x0 [0155.124] RmGetList () returned 0x0 [0156.528] RmShutdown () returned 0x0 [0157.232] RmEndSession () returned 0x0 [0157.610] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52616c8) returned 1 [0157.610] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0157.610] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x80) returned 1 [0157.610] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0157.610] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0157.610] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=3628) returned 1 [0157.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bb8568 [0157.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b6020 [0157.626] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0157.626] ReadFile (in: hFile=0x5e8, lpBuffer=0x64b6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x64b6040*, lpNumberOfBytesRead=0x3b6fc40*=0xe2c, lpOverlapped=0x0) returned 1 [0157.672] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0157.672] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bb8580*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bb8580*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0157.672] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bb8580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bb8580*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0157.672] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0157.672] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0157.672] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0157.673] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b6020 | out: hHeap=0x310000) returned 1 [0157.677] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb8568 | out: hHeap=0x310000) returned 1 [0157.678] CloseHandle (hObject=0x5e8) returned 1 [0157.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0157.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0157.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b38 [0157.679] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0157.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0157.679] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\\\588bce7c90097ed212\\header.bmp.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\header.bmp.bdcddcbaad"), dwFlags=0x1) returned 1 [0157.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399980 [0157.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0157.680] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] GetLastError () returned 0x0 [0157.680] SetLastError (dwErrCode=0x0) [0157.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0157.681] GetLastError () returned 0x0 [0157.681] SetLastError (dwErrCode=0x0) [0157.681] GetLastError () returned 0x0 [0157.681] SetLastError (dwErrCode=0x0) [0157.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0157.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0157.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x3b6fa70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eOdNRgPs7m", lpUsedDefaultChar=0x0) returned 10 [0157.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0157.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0157.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0157.681] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0157.682] WriteFile (in: hFile=0x5e8, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5d, lpOverlapped=0x0) returned 1 [0157.683] CloseHandle (hObject=0x5e8) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399980 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0157.683] CryptDestroyKey (hKey=0x52616c8) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3997c8 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5310 | out: hHeap=0x310000) returned 1 [0157.683] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5990 | out: hHeap=0x310000) returned 1 [0157.683] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0157.683] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0157.683] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.683] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0157.707] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.707] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0157.707] CloseHandle (hObject=0x5e8) returned 1 [0157.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399718 [0157.707] RmStartSession () returned 0x0 [0157.877] RmRegisterResources () returned 0x0 [0157.881] RmGetList () returned 0x0 [0161.491] RmShutdown () returned 0x0 [0161.973] RmEndSession () returned 0x0 [0162.297] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260e48) returned 1 [0162.297] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0162.297] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi", dwFileAttributes=0x80) returned 1 [0162.297] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0162.297] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0162.297] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=94720) returned 1 [0162.297] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc4670 [0162.298] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b8020 [0162.320] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0162.320] ReadFile (in: hFile=0x5e8, lpBuffer=0x64b8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x64b8040*, lpNumberOfBytesRead=0x3b6fc40*=0x17200, lpOverlapped=0x0) returned 1 [0162.392] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0162.392] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.392] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.394] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.394] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.394] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.394] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.394] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.394] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.394] CryptEncrypt (in: hKey=0x5260e48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0162.394] WriteFile (in: hFile=0x5e8, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0162.394] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0162.394] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0162.395] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0162.395] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b8020 | out: hHeap=0x310000) returned 1 [0162.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc4670 | out: hHeap=0x310000) returned 1 [0162.400] CloseHandle (hObject=0x5e8) returned 1 [0162.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0162.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f09f0 [0162.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0162.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f02e8 [0162.981] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0162.982] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0162.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399400 [0162.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0162.982] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0162.982] GetLastError () returned 0x0 [0162.982] SetLastError (dwErrCode=0x0) [0162.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4660 [0162.982] GetLastError () returned 0x0 [0162.982] SetLastError (dwErrCode=0x0) [0162.982] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.983] SetLastError (dwErrCode=0x0) [0162.983] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b490 [0162.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5291a00 [0162.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.984] SetLastError (dwErrCode=0x0) [0162.984] GetLastError () returned 0x0 [0162.985] SetLastError (dwErrCode=0x0) [0162.985] GetLastError () returned 0x0 [0162.985] SetLastError (dwErrCode=0x0) [0162.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4660 | out: hHeap=0x310000) returned 1 [0162.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0162.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x38c1d8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", lpUsedDefaultChar=0x0) returned 30 [0162.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291a00 | out: hHeap=0x310000) returned 1 [0162.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0162.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x5ad2068 [0163.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0163.479] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0163.480] WriteFile (in: hFile=0x5e8, lpBuffer=0x5ad2068*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x5ad2068*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe71, lpOverlapped=0x0) returned 1 [0163.481] CloseHandle (hObject=0x5e8) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ad2068 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399400 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f02e8 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0163.481] CryptDestroyKey (hKey=0x5260e48) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399718 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5470 | out: hHeap=0x310000) returned 1 [0163.481] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e59e0 | out: hHeap=0x310000) returned 1 [0163.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0163.482] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0163.482] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.482] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0163.527] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.528] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0163.528] CloseHandle (hObject=0x5e8) returned 1 [0163.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcab0 [0163.528] RmStartSession () returned 0x0 [0165.695] RmRegisterResources () returned 0x0 [0165.698] RmGetList () returned 0x0 [0168.546] RmShutdown () returned 0x0 [0173.185] RmEndSession () returned 0x0 [0173.186] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261708) returned 1 [0173.186] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0173.186] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0173.186] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0173.186] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0173.186] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=1052672) returned 1 [0173.186] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0173.187] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6c76020 [0173.530] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0173.530] ReadFile (in: hFile=0x690, lpBuffer=0x6c76040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6c76040*, lpNumberOfBytesRead=0x3b6fc40*=0x100000, lpOverlapped=0x0) returned 1 [0173.544] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0173.544] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.544] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.545] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.545] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.545] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.545] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.545] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.545] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.545] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.545] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.546] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.546] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.546] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.546] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.546] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.546] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.546] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.546] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.546] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.546] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.547] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.547] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.547] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.547] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.547] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.548] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.548] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.549] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.549] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.550] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.550] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.551] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.551] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.552] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.552] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.553] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.553] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.554] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.554] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.964] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.964] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.964] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.964] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.964] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.964] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.964] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.965] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.965] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.966] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.966] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.967] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.967] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.968] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.968] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.969] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.969] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.970] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.970] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.971] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.972] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.972] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0173.973] WriteFile (in: hFile=0x690, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0173.973] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0173.985] WriteFile (in: hFile=0x690, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0173.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c76020 | out: hHeap=0x310000) returned 1 [0175.426] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0175.426] CloseHandle (hObject=0x690) returned 1 [0175.449] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0175.449] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x533c520 [0175.449] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4bbafb0 [0175.449] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x533c908 [0175.449] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533c520 | out: hHeap=0x310000) returned 1 [0175.449] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0175.450] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4bbab60 [0175.450] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0175.450] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] GetLastError () returned 0x0 [0175.450] SetLastError (dwErrCode=0x0) [0175.450] GetLastError () returned 0x0 [0175.451] SetLastError (dwErrCode=0x0) [0175.451] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0175.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0175.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="37XpR", cchWideChar=5, lpMultiByteStr=0x3b6fa70, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="37XpR", lpUsedDefaultChar=0x0) returned 5 [0175.451] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0175.451] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0175.451] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0175.452] WriteFile (in: hFile=0x690, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe58, lpOverlapped=0x0) returned 1 [0175.453] CloseHandle (hObject=0x690) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbab60 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533c908 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bbafb0 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0175.453] CryptDestroyKey (hKey=0x5261708) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcab0 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391188 | out: hHeap=0x310000) returned 1 [0175.453] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a98 | out: hHeap=0x310000) returned 1 [0175.453] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0175.453] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0175.453] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.454] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0175.800] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.800] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0175.800] CloseHandle (hObject=0x690) returned 1 [0175.800] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322238 [0175.803] RmStartSession () returned 0x0 [0175.989] RmRegisterResources () returned 0x0 [0175.993] RmGetList () returned 0x0 [0176.582] RmShutdown () returned 0x0 [0180.493] RmEndSession () returned 0x0 [0180.494] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261a48) returned 1 [0180.494] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0180.495] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0180.495] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0180.495] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0180.495] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=69632) returned 1 [0180.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5e3d008 [0180.495] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6662020 [0180.893] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0180.893] ReadFile (in: hFile=0x690, lpBuffer=0x6662040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6662040*, lpNumberOfBytesRead=0x3b6fc40*=0x11000, lpOverlapped=0x0) returned 1 [0180.912] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0180.912] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.912] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.912] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.912] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.912] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.912] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.912] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.912] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.912] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.913] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.913] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.913] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.913] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0180.913] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0180.913] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0180.914] WriteFile (in: hFile=0x690, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0180.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6662020 | out: hHeap=0x310000) returned 1 [0181.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e3d008 | out: hHeap=0x310000) returned 1 [0181.441] CloseHandle (hObject=0x690) returned 1 [0181.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0181.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c8f90 [0181.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53281d0 [0181.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9e00 [0181.443] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c8f90 | out: hHeap=0x310000) returned 1 [0181.444] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0181.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327e40 [0181.445] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0181.445] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] GetLastError () returned 0x0 [0181.474] SetLastError (dwErrCode=0x0) [0181.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0181.474] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] GetLastError () returned 0x0 [0181.475] SetLastError (dwErrCode=0x0) [0181.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0181.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0181.475] GetLastError () returned 0x0 [0181.478] SetLastError (dwErrCode=0x0) [0181.478] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] GetLastError () returned 0x0 [0181.479] SetLastError (dwErrCode=0x0) [0181.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab868 [0181.479] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0181.479] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0181.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CqBUvxIGoX1t1IDWUkYIKSGN", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0181.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0181.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CqBUvxIGoX1t1IDWUkYIKSGN", cchWideChar=24, lpMultiByteStr=0x38c520, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CqBUvxIGoX1t1IDWUkYIKSGN", lpUsedDefaultChar=0x0) returned 24 [0181.479] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab868 | out: hHeap=0x310000) returned 1 [0181.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540ab08 [0181.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540e528 [0181.479] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0181.479] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0181.487] WriteFile (in: hFile=0x690, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe6b, lpOverlapped=0x0) returned 1 [0181.488] CloseHandle (hObject=0x690) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540ab08 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327e40 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9e00 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53281d0 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0181.489] CryptDestroyKey (hKey=0x5261a48) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322238 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c020 | out: hHeap=0x310000) returned 1 [0181.489] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e64c0 | out: hHeap=0x310000) returned 1 [0181.489] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0181.489] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0181.490] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.490] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0181.497] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.497] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0181.497] CloseHandle (hObject=0x690) returned 1 [0181.498] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6137748 [0181.498] RmStartSession () returned 0x0 [0182.060] RmRegisterResources () returned 0x0 [0182.060] RmGetList () returned 0x0 [0183.355] RmShutdown () returned 0x0 [0186.081] RmEndSession () returned 0x0 [0186.302] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261448) returned 1 [0186.302] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0186.302] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x20) returned 1 [0186.302] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0186.302] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0186.302] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=69632) returned 1 [0186.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5413ca0 [0186.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6774020 [0186.321] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0186.321] ReadFile (in: hFile=0x6a8, lpBuffer=0x6774040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6774040*, lpNumberOfBytesRead=0x3b6fc40*=0x11000, lpOverlapped=0x0) returned 1 [0186.432] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0186.432] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.432] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.432] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.432] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.432] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.432] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.468] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.468] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.468] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.468] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.468] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.468] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.469] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.469] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.469] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.469] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.469] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5413cc0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0186.469] WriteFile (in: hFile=0x6a8, lpBuffer=0x5413cc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5413cc0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0186.471] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0186.471] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0186.471] WriteFile (in: hFile=0x6a8, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0186.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6774020 | out: hHeap=0x310000) returned 1 [0186.533] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5413ca0 | out: hHeap=0x310000) returned 1 [0186.533] CloseHandle (hObject=0x6a8) returned 1 [0186.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0186.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51cdb20 [0186.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6137690 [0186.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51cf290 [0186.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cdb20 | out: hHeap=0x310000) returned 1 [0186.535] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0186.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61366c0 [0186.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0186.536] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0186.536] GetLastError () returned 0x0 [0186.536] SetLastError (dwErrCode=0x0) [0186.536] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0186.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTiH5xEIV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0186.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTiH5xEIV", cchWideChar=9, lpMultiByteStr=0x3b6fa70, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTiH5xEIV", lpUsedDefaultChar=0x0) returned 9 [0186.537] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0186.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540b990 [0186.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0186.537] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0186.538] WriteFile (in: hFile=0x6a8, lpBuffer=0x540b990*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x540b990*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5c, lpOverlapped=0x0) returned 1 [0186.538] CloseHandle (hObject=0x6a8) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61366c0 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cf290 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6137690 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0186.539] CryptDestroyKey (hKey=0x5261448) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6137748 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390ea8 | out: hHeap=0x310000) returned 1 [0186.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6f10 | out: hHeap=0x310000) returned 1 [0186.539] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0186.539] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0186.539] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.539] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0186.570] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.570] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0186.570] CloseHandle (hObject=0x6a8) returned 1 [0186.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0090 [0186.570] RmStartSession () returned 0x0 [0186.571] RmRegisterResources () returned 0x0 [0186.572] RmGetList () returned 0x0 [0186.849] RmShutdown () returned 0x0 [0190.028] RmEndSession () returned 0x0 [0190.029] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261508) returned 1 [0190.029] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0190.029] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0190.029] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0190.029] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0190.029] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=69632) returned 1 [0190.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5411c60 [0190.030] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6996020 [0190.268] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0190.268] ReadFile (in: hFile=0x6a8, lpBuffer=0x6996040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x6996040*, lpNumberOfBytesRead=0x3b6fc40*=0x11000, lpOverlapped=0x0) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.271] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.271] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.271] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0190.271] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0190.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0190.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6996020 | out: hHeap=0x310000) returned 1 [0190.422] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5411c60 | out: hHeap=0x310000) returned 1 [0190.422] CloseHandle (hObject=0x6a8) returned 1 [0190.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0190.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0190.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f09f0 [0190.425] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0190.425] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0190.425] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0630 [0190.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0190.426] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0190.426] GetLastError () returned 0x0 [0190.426] SetLastError (dwErrCode=0x0) [0190.426] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7d8 [0190.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] GetLastError () returned 0x0 [0190.427] SetLastError (dwErrCode=0x0) [0190.427] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0190.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0190.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0190.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tRdDQltWN4PVKdRqXUoqyy", cchWideChar=22, lpMultiByteStr=0x38c520, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tRdDQltWN4PVKdRqXUoqyy", lpUsedDefaultChar=0x0) returned 22 [0190.428] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0190.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0190.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540b990 [0190.428] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0190.428] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0190.429] WriteFile (in: hFile=0x6a8, lpBuffer=0x540b990*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x540b990*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe69, lpOverlapped=0x0) returned 1 [0190.440] CloseHandle (hObject=0x6a8) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540b990 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0630 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0190.440] CryptDestroyKey (hKey=0x5261508) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0090 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19df8 | out: hHeap=0x310000) returned 1 [0190.440] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3656d8 | out: hHeap=0x310000) returned 1 [0190.441] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0190.441] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0190.441] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.441] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0190.588] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.588] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0190.588] CloseHandle (hObject=0x6a8) returned 1 [0190.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327688 [0190.588] RmStartSession () returned 0x0 [0190.592] RmRegisterResources () returned 0x0 [0190.597] RmGetList () returned 0x0 [0191.831] RmShutdown () returned 0x0 [0194.738] RmEndSession () returned 0x0 [0194.739] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261848) returned 1 [0194.739] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0194.739] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x20) returned 1 [0194.739] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0194.739] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0194.739] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=69632) returned 1 [0194.739] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b7ef88 [0194.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b2020 [0195.065] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0195.065] ReadFile (in: hFile=0x6a8, lpBuffer=0x64b2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x64b2040*, lpNumberOfBytesRead=0x3b6fc40*=0x11000, lpOverlapped=0x0) returned 1 [0195.067] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0195.067] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.067] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.068] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.069] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.069] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0195.069] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0195.069] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x6a8, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0195.069] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b2020 | out: hHeap=0x310000) returned 1 [0195.980] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7ef88 | out: hHeap=0x310000) returned 1 [0195.980] CloseHandle (hObject=0x6a8) returned 1 [0195.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0195.980] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5356f00 [0195.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c3b0 [0195.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5357638 [0195.981] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5356f00 | out: hHeap=0x310000) returned 1 [0195.981] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0195.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532b318 [0195.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0195.981] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0195.981] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc230 [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0195.982] GetLastError () returned 0x0 [0195.982] SetLastError (dwErrCode=0x0) [0195.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc230 | out: hHeap=0x310000) returned 1 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0195.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2gHNuRbsv", cchWideChar=9, lpMultiByteStr=0x3b6fa70, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2gHNuRbsv", lpUsedDefaultChar=0x0) returned 9 [0195.982] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0195.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0195.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0195.983] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0195.983] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5c, lpOverlapped=0x0) returned 1 [0195.984] CloseHandle (hObject=0x6a8) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532b318 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5357638 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c3b0 | out: hHeap=0x310000) returned 1 [0195.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0195.984] CryptDestroyKey (hKey=0x5261848) returned 1 [0195.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327688 | out: hHeap=0x310000) returned 1 [0195.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c280 | out: hHeap=0x310000) returned 1 [0195.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44bc8 | out: hHeap=0x310000) returned 1 [0195.985] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0195.985] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0195.985] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.985] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0195.997] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.997] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0195.997] CloseHandle (hObject=0x6a8) returned 1 [0195.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5357638 [0195.997] RmStartSession () returned 0x0 [0196.000] RmRegisterResources () returned 0x0 [0196.004] RmGetList () returned 0x0 [0197.275] RmShutdown () returned 0x0 [0198.932] RmEndSession () returned 0x0 [0198.933] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261908) returned 1 [0198.933] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0198.933] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0198.933] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0198.934] CryptDestroyKey (hKey=0x5261908) returned 1 [0198.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5357638 | out: hHeap=0x310000) returned 1 [0198.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c933f0 | out: hHeap=0x310000) returned 1 [0198.934] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07dd0 | out: hHeap=0x310000) returned 1 [0198.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0198.934] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0198.934] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.934] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0198.939] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.939] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0198.939] CloseHandle (hObject=0x6a8) returned 1 [0198.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x51bac10 [0198.939] RmStartSession () returned 0x0 [0198.943] RmRegisterResources () returned 0x0 [0198.947] RmGetList () returned 0x0 [0199.836] RmShutdown () returned 0x0 [0201.898] RmEndSession () returned 0x0 [0201.900] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x35dd08) returned 1 [0201.900] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0201.900] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", dwFileAttributes=0x20) returned 0 [0201.900] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0201.900] CryptDestroyKey (hKey=0x35dd08) returned 1 [0201.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bac10 | out: hHeap=0x310000) returned 1 [0201.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390778 | out: hHeap=0x310000) returned 1 [0201.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c080f0 | out: hHeap=0x310000) returned 1 [0201.900] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0201.900] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0201.900] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.901] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0201.924] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.924] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0201.924] CloseHandle (hObject=0x6a8) returned 1 [0201.924] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6bf8 [0201.924] RmStartSession () returned 0x0 [0201.928] RmRegisterResources () returned 0x0 [0202.432] RmGetList () returned 0x0 [0202.997] RmShutdown () returned 0x0 [0207.179] RmEndSession () returned 0x0 [0207.180] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261448) returned 1 [0207.180] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0207.180] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui", dwFileAttributes=0x20) returned 0 [0207.180] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.181] CryptDestroyKey (hKey=0x5261448) returned 1 [0207.181] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6bf8 | out: hHeap=0x310000) returned 1 [0207.181] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92628 | out: hHeap=0x310000) returned 1 [0207.181] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07ba0 | out: hHeap=0x310000) returned 1 [0207.181] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0207.181] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0207.408] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.408] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0207.443] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.443] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0207.443] CloseHandle (hObject=0x52c) returned 1 [0207.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ebc70 [0207.443] RmStartSession () returned 0x0 [0207.446] RmRegisterResources () returned 0x0 [0207.446] RmGetList () returned 0x0 [0207.913] RmShutdown () returned 0x0 [0210.631] RmEndSession () returned 0x0 [0210.633] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x35da08) returned 1 [0210.633] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0210.633] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", dwFileAttributes=0x20) returned 0 [0210.633] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.633] CryptDestroyKey (hKey=0x35da08) returned 1 [0210.633] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ebc70 | out: hHeap=0x310000) returned 1 [0210.633] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0210.633] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08410 | out: hHeap=0x310000) returned 1 [0210.633] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0210.633] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0210.634] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.634] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0210.635] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.635] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0210.635] CloseHandle (hObject=0x52c) returned 1 [0210.635] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92190 [0210.635] RmStartSession () returned 0x0 [0210.638] RmRegisterResources () returned 0x0 [0210.643] RmGetList () returned 0x0 [0211.736] RmShutdown () returned 0x0 [0212.530] RmEndSession () returned 0x0 [0212.531] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260f88) returned 1 [0212.531] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0212.531] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", dwFileAttributes=0x20) returned 0 [0212.531] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.531] CryptDestroyKey (hKey=0x5260f88) returned 1 [0212.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92190 | out: hHeap=0x310000) returned 1 [0212.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0212.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5c90 | out: hHeap=0x310000) returned 1 [0212.531] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0212.531] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0212.531] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.531] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0212.549] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.549] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0212.550] CloseHandle (hObject=0x52c) returned 1 [0212.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0212.550] RmStartSession () returned 0x0 [0212.553] RmRegisterResources () returned 0x0 [0213.256] RmGetList () returned 0x0 [0214.496] RmShutdown () returned 0x0 [0219.241] RmEndSession () returned 0x0 [0219.678] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260b88) returned 1 [0219.678] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0219.678] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0219.679] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.679] CryptDestroyKey (hKey=0x5260b88) returned 1 [0219.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0219.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0219.679] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5ce0 | out: hHeap=0x310000) returned 1 [0219.679] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0219.679] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0219.679] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.679] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0219.808] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.808] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0219.808] CloseHandle (hObject=0x5d4) returned 1 [0219.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b68b0 [0219.808] RmStartSession () returned 0x0 [0219.809] RmRegisterResources () returned 0x0 [0220.266] RmGetList () returned 0x0 [0220.309] RmShutdown () returned 0x0 [0225.060] RmEndSession () returned 0x0 [0225.611] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260f08) returned 1 [0225.612] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0225.612] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.612] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.612] CryptDestroyKey (hKey=0x5260f08) returned 1 [0225.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b68b0 | out: hHeap=0x310000) returned 1 [0225.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0225.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14a10 | out: hHeap=0x310000) returned 1 [0225.612] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0225.612] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0225.622] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.622] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0225.626] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.626] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0225.626] CloseHandle (hObject=0x56c) returned 1 [0225.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0225.626] RmStartSession () returned 0x0 [0225.889] RmRegisterResources () returned 0x0 [0225.893] RmGetList () returned 0x0 [0227.339] RmShutdown () returned 0x0 [0228.010] RmEndSession () returned 0x0 [0228.449] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261448) returned 1 [0228.449] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0228.449] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", dwFileAttributes=0x20) returned 0 [0228.449] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.503] CryptDestroyKey (hKey=0x5261448) returned 1 [0228.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0228.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c610 | out: hHeap=0x310000) returned 1 [0228.504] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c141a0 | out: hHeap=0x310000) returned 1 [0228.504] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0228.504] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0228.610] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.610] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0228.615] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.615] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0228.616] CloseHandle (hObject=0x518) returned 1 [0228.616] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0228.616] RmStartSession () returned 0x0 [0228.618] RmRegisterResources () returned 0x0 [0228.619] RmGetList () returned 0x0 [0228.830] RmShutdown () returned 0x0 [0229.730] RmEndSession () returned 0x0 [0229.810] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52610c8) returned 1 [0229.810] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0229.810] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg", dwFileAttributes=0x20) returned 0 [0229.810] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.810] CryptDestroyKey (hKey=0x52610c8) returned 1 [0229.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0229.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55713e0 | out: hHeap=0x310000) returned 1 [0229.810] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c15000 | out: hHeap=0x310000) returned 1 [0229.810] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0229.811] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0229.811] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.811] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0229.816] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.816] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0229.816] CloseHandle (hObject=0x518) returned 1 [0229.816] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3effa0 [0229.817] RmStartSession () returned 0x0 [0229.998] RmRegisterResources () returned 0x0 [0229.998] RmGetList () returned 0x0 [0230.883] RmShutdown () returned 0x0 [0231.588] RmEndSession () returned 0x0 [0231.950] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52617c8) returned 1 [0231.950] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0231.950] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado20.tlb", dwFileAttributes=0x20) returned 0 [0231.950] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.950] CryptDestroyKey (hKey=0x52617c8) returned 1 [0231.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3effa0 | out: hHeap=0x310000) returned 1 [0231.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0231.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19330 | out: hHeap=0x310000) returned 1 [0231.950] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0231.950] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0231.950] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.950] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0231.984] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.985] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0231.985] CloseHandle (hObject=0x5d4) returned 1 [0231.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19948 [0231.985] RmStartSession () returned 0x0 [0231.987] RmRegisterResources () returned 0x0 [0231.990] RmGetList () returned 0x0 [0234.350] RmShutdown () returned 0x0 [0235.498] RmEndSession () returned 0x0 [0235.499] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261408) returned 1 [0235.499] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0235.499] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", dwFileAttributes=0x20) returned 0 [0235.499] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.499] CryptDestroyKey (hKey=0x5261408) returned 1 [0235.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0235.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0235.499] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572978 | out: hHeap=0x310000) returned 1 [0235.499] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0235.499] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0235.500] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.500] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0235.501] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.501] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0235.501] CloseHandle (hObject=0x5d4) returned 1 [0235.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0235.501] RmStartSession () returned 0x0 [0235.502] RmRegisterResources () returned 0x0 [0235.506] RmGetList () returned 0x0 [0237.835] RmShutdown () returned 0x0 [0242.029] RmEndSession () returned 0x0 [0242.322] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261448) returned 1 [0242.322] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0242.322] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 1 [0242.322] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0242.322] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0242.322] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=149) returned 1 [0242.322] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0242.323] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3a020 [0242.340] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0242.340] ReadFile (in: hFile=0x5d4, lpBuffer=0x4d3a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x4d3a040*, lpNumberOfBytesRead=0x3b6fc40*=0x95, lpOverlapped=0x0) returned 1 [0242.754] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0242.754] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0242.754] WriteFile (in: hFile=0x5d4, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0242.828] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0242.828] WriteFile (in: hFile=0x5d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0242.828] WriteFile (in: hFile=0x5d4, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0242.829] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d3a020 | out: hHeap=0x310000) returned 1 [0242.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0242.935] CloseHandle (hObject=0x5d4) returned 1 [0242.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0242.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0242.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0242.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0242.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0242.935] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0242.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0242.936] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0242.936] GetLastError () returned 0x0 [0242.937] SetLastError (dwErrCode=0x0) [0242.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0242.937] GetLastError () returned 0x0 [0242.937] SetLastError (dwErrCode=0x0) [0242.937] GetLastError () returned 0x0 [0242.937] SetLastError (dwErrCode=0x0) [0242.937] GetLastError () returned 0x0 [0242.937] SetLastError (dwErrCode=0x0) [0242.937] GetLastError () returned 0x0 [0242.937] SetLastError (dwErrCode=0x0) [0242.937] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0242.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0242.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HTk", cchWideChar=3, lpMultiByteStr=0x3b6fa70, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HTk", lpUsedDefaultChar=0x0) returned 3 [0242.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0242.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0242.937] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0242.937] WriteFile (in: hFile=0x5d4, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe56, lpOverlapped=0x0) returned 1 [0242.938] CloseHandle (hObject=0x5d4) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0242.938] CryptDestroyKey (hKey=0x5261448) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571a68 | out: hHeap=0x310000) returned 1 [0242.938] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571f78 | out: hHeap=0x310000) returned 1 [0242.938] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0242.939] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0242.941] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.941] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0243.033] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.033] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0243.033] CloseHandle (hObject=0x5d4) returned 1 [0243.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a140 [0243.033] RmStartSession () returned 0x0 [0243.035] RmRegisterResources () returned 0x0 [0243.039] RmGetList () returned 0x0 [0245.721] RmShutdown () returned 0x0 [0247.467] RmEndSession () returned 0x0 [0247.468] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260d88) returned 1 [0247.468] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0247.468] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar", dwFileAttributes=0x20) returned 1 [0247.468] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0247.468] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0247.468] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=42185) returned 1 [0247.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54cfe68 [0247.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c9020 [0250.832] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.832] SetLastError (dwErrCode=0x0) [0250.832] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7a0 [0250.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.833] SetLastError (dwErrCode=0x0) [0250.833] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x50ee9b0 [0250.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] GetLastError () returned 0x0 [0250.834] SetLastError (dwErrCode=0x0) [0250.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0250.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0250.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c1d8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0250.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ee9b0 | out: hHeap=0x310000) returned 1 [0250.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0250.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eb8d0 [0250.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0250.834] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0250.835] WriteFile (in: hFile=0x5d4, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe70, lpOverlapped=0x0) returned 1 [0250.836] CloseHandle (hObject=0x5d4) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a488 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0250.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0250.837] CryptDestroyKey (hKey=0x5260d88) returned 1 [0250.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a140 | out: hHeap=0x310000) returned 1 [0250.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c397d8 | out: hHeap=0x310000) returned 1 [0250.837] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352a10 | out: hHeap=0x310000) returned 1 [0250.837] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0250.837] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0250.837] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.837] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0250.839] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.839] ReadFile (in: hFile=0x5d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0250.839] CloseHandle (hObject=0x5d4) returned 1 [0250.839] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0250.839] RmStartSession () returned 0x0 [0250.841] RmRegisterResources () returned 0x0 [0250.842] RmGetList () returned 0x0 [0250.870] RmShutdown () returned 0x0 [0252.560] RmEndSession () returned 0x0 [0252.704] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5260c48) returned 1 [0252.704] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0252.704] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template", dwFileAttributes=0x20) returned 1 [0252.704] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0252.705] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0252.705] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=3376) returned 1 [0252.705] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0252.705] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65ca020 [0252.723] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0252.723] ReadFile (in: hFile=0x484, lpBuffer=0x65ca040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x65ca040*, lpNumberOfBytesRead=0x3b6fc40*=0xd30, lpOverlapped=0x0) returned 1 [0252.725] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0252.725] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0252.725] WriteFile (in: hFile=0x484, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0252.725] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0252.725] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0252.726] WriteFile (in: hFile=0x484, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0252.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65ca020 | out: hHeap=0x310000) returned 1 [0252.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d6a020 | out: hHeap=0x310000) returned 1 [0252.731] CloseHandle (hObject=0x484) returned 1 [0252.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0252.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0252.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0252.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0252.732] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0252.732] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.bdcddcbaad"), dwFlags=0x1) returned 1 [0252.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0252.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c90 [0252.732] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0252.732] GetLastError () returned 0x0 [0252.732] SetLastError (dwErrCode=0x0) [0252.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0252.733] GetLastError () returned 0x0 [0252.733] SetLastError (dwErrCode=0x0) [0252.733] GetLastError () returned 0x0 [0252.733] SetLastError (dwErrCode=0x0) [0252.733] GetLastError () returned 0x0 [0252.733] SetLastError (dwErrCode=0x0) [0252.733] GetLastError () returned 0x0 [0252.733] SetLastError (dwErrCode=0x0) [0252.733] GetLastError () returned 0x0 [0252.733] SetLastError (dwErrCode=0x0) [0252.733] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0252.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0252.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x3b6fa70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0252.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0252.733] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0252.733] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0252.733] WriteFile (in: hFile=0x484, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe57, lpOverlapped=0x0) returned 1 [0252.734] CloseHandle (hObject=0x484) returned 1 [0252.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c90 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0252.735] CryptDestroyKey (hKey=0x5260c48) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55703d8 | out: hHeap=0x310000) returned 1 [0252.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352f10 | out: hHeap=0x310000) returned 1 [0252.735] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0252.735] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0252.735] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.735] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0252.914] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.914] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0252.914] CloseHandle (hObject=0x484) returned 1 [0252.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd6d0 [0252.914] RmStartSession () returned 0x0 [0252.957] RmRegisterResources () returned 0x0 [0252.958] RmGetList () returned 0x0 [0253.057] RmShutdown () returned 0x0 [0254.115] RmEndSession () returned 0x0 [0254.116] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52616c8) returned 1 [0254.116] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0254.116] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts", dwFileAttributes=0x20) returned 1 [0254.116] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0254.116] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0254.116] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=114923) returned 1 [0254.116] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0254.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x789f020 [0254.516] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0254.516] ReadFile (in: hFile=0x484, lpBuffer=0x789f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x789f040*, lpNumberOfBytesRead=0x3b6fc40*=0x1c0eb, lpOverlapped=0x0) returned 1 [0254.521] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0254.521] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.521] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.521] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.521] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.522] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.522] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0254.523] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0254.523] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0254.524] WriteFile (in: hFile=0x484, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0254.524] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x789f020 | out: hHeap=0x310000) returned 1 [0254.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0254.935] CloseHandle (hObject=0x484) returned 1 [0254.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0254.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0254.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0254.935] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0254.935] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0254.935] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.bdcddcbaad"), dwFlags=0x1) returned 1 [0254.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0254.936] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d197e0 [0254.947] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] GetLastError () returned 0x0 [0254.948] SetLastError (dwErrCode=0x0) [0254.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0254.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0254.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x3b6fa70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx231C421W", lpUsedDefaultChar=0x0) returned 10 [0254.949] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0254.949] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0254.949] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0254.949] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0254.950] WriteFile (in: hFile=0x484, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5d, lpOverlapped=0x0) returned 1 [0254.950] CloseHandle (hObject=0x484) returned 1 [0254.950] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d197e0 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0254.951] CryptDestroyKey (hKey=0x52616c8) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd6d0 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a33c8 | out: hHeap=0x310000) returned 1 [0254.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53533c0 | out: hHeap=0x310000) returned 1 [0254.951] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0254.951] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0254.951] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.951] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0254.952] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.952] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0254.952] CloseHandle (hObject=0x484) returned 1 [0254.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391e50 [0254.952] RmStartSession () returned 0x0 [0254.954] RmRegisterResources () returned 0x0 [0254.954] RmGetList () returned 0x0 [0255.001] RmShutdown () returned 0x0 [0258.367] RmEndSession () returned 0x0 [0258.368] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52616c8) returned 1 [0258.368] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0258.368] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\LICENSE", dwFileAttributes=0x20) returned 1 [0258.368] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0258.368] CryptEncrypt (in: hKey=0x52616c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0258.368] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=40) returned 1 [0258.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5f14028 [0258.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e8020 [0261.964] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0261.964] GetLastError () returned 0x0 [0261.964] SetLastError (dwErrCode=0x0) [0261.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0261.964] GetLastError () returned 0x0 [0261.964] SetLastError (dwErrCode=0x0) [0261.964] GetLastError () returned 0x0 [0261.964] SetLastError (dwErrCode=0x0) [0261.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0261.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0261.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x3b6fa70, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3", lpUsedDefaultChar=0x0) returned 1 [0261.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0261.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0261.965] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0261.966] WriteFile (in: hFile=0x484, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe54, lpOverlapped=0x0) returned 1 [0261.967] CloseHandle (hObject=0x484) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398ed8 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391cb0 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a398 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0261.967] CryptDestroyKey (hKey=0x52616c8) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391e50 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1e98 | out: hHeap=0x310000) returned 1 [0261.967] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53520b0 | out: hHeap=0x310000) returned 1 [0261.967] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0261.967] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0261.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.969] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0261.971] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.971] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0261.971] CloseHandle (hObject=0x484) returned 1 [0261.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0a148 [0261.972] RmStartSession () returned 0x0 [0261.974] RmRegisterResources () returned 0x0 [0261.975] RmGetList () returned 0x0 [0261.997] RmShutdown () returned 0x0 [0264.887] RmEndSession () returned 0x0 [0264.888] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261048) returned 1 [0264.888] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0264.888] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.889] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0264.889] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0264.889] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=1261) returned 1 [0264.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0264.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e0020 [0265.725] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.726] GetLastError () returned 0x0 [0265.726] SetLastError (dwErrCode=0x0) [0265.727] GetLastError () returned 0x0 [0265.727] SetLastError (dwErrCode=0x0) [0265.727] GetLastError () returned 0x0 [0265.727] SetLastError (dwErrCode=0x0) [0265.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0265.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0265.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x3b6fa70, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0265.727] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0265.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0265.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0265.727] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0265.727] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0265.728] WriteFile (in: hFile=0x484, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe61, lpOverlapped=0x0) returned 1 [0265.729] CloseHandle (hObject=0x484) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f059b0 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5399078 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04878 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0265.729] CryptDestroyKey (hKey=0x5261048) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0a148 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53490e8 | out: hHeap=0x310000) returned 1 [0265.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c197e0 | out: hHeap=0x310000) returned 1 [0265.729] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0265.729] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0265.729] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.729] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0265.731] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0265.731] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0265.731] CloseHandle (hObject=0x484) returned 1 [0265.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0a148 [0265.731] RmStartSession () returned 0x0 [0265.862] RmRegisterResources () returned 0x0 [0265.863] RmGetList () returned 0x0 [0265.935] RmShutdown () returned 0x0 [0267.252] RmEndSession () returned 0x0 [0267.253] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52619c8) returned 1 [0267.253] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0267.253] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0267.253] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0267.253] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0267.253] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=527958) returned 1 [0267.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0267.254] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b0020 [0267.893] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.893] GetLastError () returned 0x0 [0267.893] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0267.894] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] GetLastError () returned 0x0 [0267.894] SetLastError (dwErrCode=0x0) [0267.894] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0267.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0267.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0267.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3PiqIn2wVpHXSiax4SL", cchWideChar=20, lpMultiByteStr=0x38c160, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3PiqIn2wVpHXSiax4SL", lpUsedDefaultChar=0x0) returned 20 [0267.894] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0267.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0267.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0267.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0267.895] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0267.895] WriteFile (in: hFile=0x4ac, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe67, lpOverlapped=0x0) returned 1 [0267.896] CloseHandle (hObject=0x4ac) returned 1 [0267.896] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0267.896] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0267.896] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0d38 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b9f838 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539dd00 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba48e0 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0267.897] CryptDestroyKey (hKey=0x52619c8) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0a148 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348c60 | out: hHeap=0x310000) returned 1 [0267.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c193d0 | out: hHeap=0x310000) returned 1 [0267.897] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0267.897] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0267.899] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.899] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0267.900] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0267.900] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0267.900] CloseHandle (hObject=0x4ac) returned 1 [0267.900] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0267.900] RmStartSession () returned 0x0 [0267.901] RmRegisterResources () returned 0x0 [0267.901] RmGetList () returned 0x0 [0267.925] RmShutdown () returned 0x0 [0269.544] RmEndSession () returned 0x0 [0269.546] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261908) returned 1 [0269.546] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0269.546] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF", dwFileAttributes=0x220) returned 1 [0269.546] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0269.546] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0269.546] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=517) returned 1 [0269.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0269.547] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x621b020 [0269.897] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0269.897] GetLastError () returned 0x0 [0269.897] SetLastError (dwErrCode=0x0) [0269.897] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0269.897] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] SetLastError (dwErrCode=0x0) [0269.898] GetLastError () returned 0x0 [0269.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0269.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0269.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c070, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0269.898] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89eb0 | out: hHeap=0x310000) returned 1 [0269.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0269.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0269.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0269.898] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0269.899] WriteFile (in: hFile=0x4ac, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe6e, lpOverlapped=0x0) returned 1 [0269.900] CloseHandle (hObject=0x4ac) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0269.900] CryptDestroyKey (hKey=0x5261908) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4c80 | out: hHeap=0x310000) returned 1 [0269.900] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3220 | out: hHeap=0x310000) returned 1 [0269.900] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0269.900] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0269.901] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.901] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0269.920] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0269.921] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0269.921] CloseHandle (hObject=0x4ac) returned 1 [0269.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0269.921] RmStartSession () returned 0x0 [0269.923] RmRegisterResources () returned 0x0 [0269.927] RmGetList () returned 0x0 [0271.044] RmShutdown () returned 0x0 [0271.645] RmEndSession () returned 0x0 [0271.646] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261988) returned 1 [0271.646] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0271.646] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF", dwFileAttributes=0x220) returned 1 [0271.646] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0271.646] CryptEncrypt (in: hKey=0x5261988, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0271.646] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=5315) returned 1 [0271.646] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0271.647] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5801020 [0271.988] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0271.988] GetLastError () returned 0x0 [0271.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0271.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bY", cchWideChar=2, lpMultiByteStr=0x3b6fa70, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bY", lpUsedDefaultChar=0x0) returned 2 [0271.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0271.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0271.989] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0271.990] WriteFile (in: hFile=0x4ac, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe55, lpOverlapped=0x0) returned 1 [0271.990] CloseHandle (hObject=0x4ac) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0271.991] CryptDestroyKey (hKey=0x5261988) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5600 | out: hHeap=0x310000) returned 1 [0271.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2fa0 | out: hHeap=0x310000) returned 1 [0271.991] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0271.991] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0271.991] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.991] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0272.001] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.001] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0272.001] CloseHandle (hObject=0x4ac) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0272.002] RmStartSession () returned 0x0 [0272.002] RmRegisterResources () returned 0x0 [0272.003] RmGetList () returned 0x0 [0272.048] RmShutdown () returned 0x0 [0274.681] RmEndSession () returned 0x0 [0274.682] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52618c8) returned 1 [0274.682] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0274.682] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF", dwFileAttributes=0x220) returned 1 [0274.682] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0274.682] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0274.682] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=9248) returned 1 [0274.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0274.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e6020 [0274.991] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0274.991] GetLastError () returned 0x0 [0274.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0274.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AueEgBICpon", cchWideChar=11, lpMultiByteStr=0x3b6fa70, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AueEgBICpon", lpUsedDefaultChar=0x0) returned 11 [0274.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0274.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0274.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0274.991] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0274.992] WriteFile (in: hFile=0x4ac, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5e, lpOverlapped=0x0) returned 1 [0274.993] CloseHandle (hObject=0x4ac) returned 1 [0274.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0274.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0274.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0274.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0274.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cf850 | out: hHeap=0x310000) returned 1 [0274.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0274.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0274.994] CryptDestroyKey (hKey=0x52618c8) returned 1 [0274.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0274.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5d20 | out: hHeap=0x310000) returned 1 [0274.994] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2cd0 | out: hHeap=0x310000) returned 1 [0274.994] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0274.994] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0274.994] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.994] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0275.004] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0275.004] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0275.004] CloseHandle (hObject=0x4ac) returned 1 [0275.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0275.005] RmStartSession () returned 0x0 [0275.006] RmRegisterResources () returned 0x0 [0275.007] RmGetList () returned 0x0 [0275.489] RmShutdown () returned 0x0 [0276.623] RmEndSession () returned 0x0 [0276.624] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261448) returned 1 [0276.624] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0276.625] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF", dwFileAttributes=0x220) returned 1 [0276.625] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0276.625] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0276.625] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=7072) returned 1 [0276.625] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0276.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79e3020 [0277.578] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0277.578] GetLastError () returned 0x0 [0277.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0277.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0277.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x38c390, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terRLaOJV2Dtqoxu0p", lpUsedDefaultChar=0x0) returned 18 [0277.578] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0277.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0277.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0277.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.578] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0277.579] WriteFile (in: hFile=0x4ac, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe65, lpOverlapped=0x0) returned 1 [0277.580] CloseHandle (hObject=0x4ac) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a57c8 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0277.580] CryptDestroyKey (hKey=0x5261448) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6a30 | out: hHeap=0x310000) returned 1 [0277.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e37c0 | out: hHeap=0x310000) returned 1 [0277.581] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0277.581] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0277.581] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.581] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0277.584] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.584] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0277.584] CloseHandle (hObject=0x4ac) returned 1 [0277.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0277.584] RmStartSession () returned 0x0 [0277.585] RmRegisterResources () returned 0x0 [0277.586] RmGetList () returned 0x0 [0277.620] RmShutdown () returned 0x0 [0278.834] RmEndSession () returned 0x0 [0278.835] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52615c8) returned 1 [0278.835] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0278.835] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF", dwFileAttributes=0x220) returned 1 [0278.835] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0278.835] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0278.835] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=6632) returned 1 [0278.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0278.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x77c7020 [0279.701] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0279.708] ReadFile (in: hFile=0x4ac, lpBuffer=0x77c7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x77c7040*, lpNumberOfBytesRead=0x3b6fc40*=0x19e8, lpOverlapped=0x0) returned 1 [0279.712] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0279.712] CryptEncrypt (in: hKey=0x52615c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0279.712] WriteFile (in: hFile=0x4ac, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0279.713] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0279.713] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0279.713] WriteFile (in: hFile=0x4ac, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0279.713] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x77c7020 | out: hHeap=0x310000) returned 1 [0281.016] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0281.016] CloseHandle (hObject=0x4ac) returned 1 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3248 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0281.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0281.017] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0281.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0281.018] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0281.019] GetLastError () returned 0x0 [0281.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0281.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0281.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", cchWideChar=31, lpMultiByteStr=0x38c098, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I9mOAOXXNU3eJWWYhwPLnBHKp1Yhbja", lpUsedDefaultChar=0x0) returned 31 [0281.019] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e800e0 | out: hHeap=0x310000) returned 1 [0281.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0281.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0281.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0281.019] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0281.020] WriteFile (in: hFile=0x4ac, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe72, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe72, lpOverlapped=0x0) returned 1 [0281.021] CloseHandle (hObject=0x4ac) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3248 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0281.021] CryptDestroyKey (hKey=0x52615c8) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0281.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6570 | out: hHeap=0x310000) returned 1 [0281.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e20a0 | out: hHeap=0x310000) returned 1 [0281.022] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0281.022] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0281.022] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.022] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0281.076] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0281.076] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0281.076] CloseHandle (hObject=0x4ac) returned 1 [0281.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0281.077] RmStartSession () returned 0x0 [0281.077] RmRegisterResources () returned 0x0 [0281.078] RmGetList () returned 0x0 [0281.099] RmShutdown () returned 0x0 [0283.231] RmEndSession () returned 0x0 [0283.340] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x52618c8) returned 1 [0283.340] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0283.341] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF", dwFileAttributes=0x220) returned 1 [0283.341] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0283.341] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0283.341] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=5004) returned 1 [0283.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c6d010 [0283.341] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f8020 [0283.359] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0283.359] ReadFile (in: hFile=0x558, lpBuffer=0x76f8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x76f8040*, lpNumberOfBytesRead=0x3b6fc40*=0x138c, lpOverlapped=0x0) returned 1 [0283.361] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0283.362] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0283.362] WriteFile (in: hFile=0x558, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0283.362] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0283.362] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0283.362] WriteFile (in: hFile=0x558, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0283.362] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f8020 | out: hHeap=0x310000) returned 1 [0283.367] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c6d010 | out: hHeap=0x310000) returned 1 [0283.367] CloseHandle (hObject=0x558) returned 1 [0283.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0283.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0283.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0283.367] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0283.367] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0283.367] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0283.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a54d0 [0283.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0283.368] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0283.368] GetLastError () returned 0x0 [0283.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0283.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x3b6fa70, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1tVbp", lpUsedDefaultChar=0x0) returned 5 [0283.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0283.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0283.369] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0283.370] WriteFile (in: hFile=0x558, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe58, lpOverlapped=0x0) returned 1 [0283.371] CloseHandle (hObject=0x558) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a54d0 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0283.371] CryptDestroyKey (hKey=0x52618c8) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c949c8 | out: hHeap=0x310000) returned 1 [0283.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2280 | out: hHeap=0x310000) returned 1 [0283.371] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0283.371] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0283.372] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.372] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0283.373] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.373] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0283.373] CloseHandle (hObject=0x558) returned 1 [0283.373] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0283.374] RmStartSession () returned 0x0 [0283.376] RmRegisterResources () returned 0x0 [0283.377] RmGetList () returned 0x0 [0284.786] RmShutdown () returned 0x0 [0285.416] RmEndSession () returned 0x0 [0285.417] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261888) returned 1 [0285.417] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0285.417] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x220) returned 1 [0285.417] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0285.417] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0285.417] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=16112) returned 1 [0285.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c0f008 [0285.418] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b0b020 [0285.436] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0285.436] ReadFile (in: hFile=0x558, lpBuffer=0x7b0b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x7b0b040*, lpNumberOfBytesRead=0x3b6fc40*=0x3ef0, lpOverlapped=0x0) returned 1 [0285.495] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0285.495] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0285.495] WriteFile (in: hFile=0x558, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0285.496] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0f020*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0f020*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0285.496] WriteFile (in: hFile=0x558, lpBuffer=0x6c0f020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x6c0f020*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0285.496] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0285.496] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0285.496] WriteFile (in: hFile=0x558, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0285.496] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7b0b020 | out: hHeap=0x310000) returned 1 [0285.501] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c0f008 | out: hHeap=0x310000) returned 1 [0285.501] CloseHandle (hObject=0x558) returned 1 [0285.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0285.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c16e8 [0285.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0285.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0285.502] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c16e8 | out: hHeap=0x310000) returned 1 [0285.502] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0285.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0285.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0285.502] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0285.502] GetLastError () returned 0x0 [0285.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x3b6fa70, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0285.503] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0285.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0285.503] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0285.503] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0285.504] WriteFile (in: hFile=0x558, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe5f, lpOverlapped=0x0) returned 1 [0285.505] CloseHandle (hObject=0x558) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0285.505] CryptDestroyKey (hKey=0x5261888) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94768 | out: hHeap=0x310000) returned 1 [0285.505] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e23c0 | out: hHeap=0x310000) returned 1 [0285.505] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0285.505] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0285.505] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.505] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0286.090] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.090] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0286.090] CloseHandle (hObject=0x558) returned 1 [0286.090] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2a90 [0286.090] RmStartSession () returned 0x0 [0286.092] RmRegisterResources () returned 0x0 [0286.092] RmGetList () returned 0x0 [0286.263] RmShutdown () returned 0x0 [0288.901] RmEndSession () returned 0x0 [0288.902] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261088) returned 1 [0288.902] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0288.902] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF", dwFileAttributes=0x220) returned 1 [0288.903] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0288.903] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0288.903] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=47786) returned 1 [0288.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0288.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c7020 [0289.214] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0289.214] ReadFile (in: hFile=0x558, lpBuffer=0x65c7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x65c7040*, lpNumberOfBytesRead=0x3b6fc40*=0xbaaa, lpOverlapped=0x0) returned 1 [0289.216] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0289.216] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.216] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0289.217] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0289.217] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0289.218] WriteFile (in: hFile=0x558, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0289.218] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c7020 | out: hHeap=0x310000) returned 1 [0289.392] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0289.392] CloseHandle (hObject=0x558) returned 1 [0289.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0289.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0289.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5860 [0289.393] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3fe0 [0289.393] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0289.393] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0289.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a58f8 [0289.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0289.398] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0289.398] GetLastError () returned 0x0 [0289.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0289.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0289.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ac9GKTK0aPkhGvcK4dkln2M2j", cchWideChar=25, lpMultiByteStr=0x38c3b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ac9GKTK0aPkhGvcK4dkln2M2j", lpUsedDefaultChar=0x0) returned 25 [0289.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e370 | out: hHeap=0x310000) returned 1 [0289.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0289.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0289.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0289.399] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0289.399] WriteFile (in: hFile=0x558, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe6c, lpOverlapped=0x0) returned 1 [0289.400] CloseHandle (hObject=0x558) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3fe0 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5860 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0289.400] CryptDestroyKey (hKey=0x5261088) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2a90 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c955a8 | out: hHeap=0x310000) returned 1 [0289.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2460 | out: hHeap=0x310000) returned 1 [0289.401] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0289.401] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0289.401] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.401] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0289.406] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.407] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0289.407] CloseHandle (hObject=0x558) returned 1 [0289.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4db0 [0289.407] RmStartSession () returned 0x0 [0290.210] RmRegisterResources () returned 0x0 [0290.210] RmGetList () returned 0x0 [0290.412] RmShutdown () returned 0x0 [0290.655] RmEndSession () returned 0x0 [0290.840] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x5261ac8) returned 1 [0290.840] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0290.840] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF", dwFileAttributes=0x220) returned 1 [0290.840] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0290.840] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0290.840] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=12520) returned 1 [0290.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0290.841] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d3b020 [0290.860] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0290.860] ReadFile (in: hFile=0x678, lpBuffer=0x4d3b040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x4d3b040*, lpNumberOfBytesRead=0x3b6fc40*=0x30e8, lpOverlapped=0x0) returned 1 [0290.937] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0290.937] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0290.937] WriteFile (in: hFile=0x678, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0290.937] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0290.937] WriteFile (in: hFile=0x678, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0290.937] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0290.937] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0290.937] WriteFile (in: hFile=0x678, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0290.937] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d3b020 | out: hHeap=0x310000) returned 1 [0290.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0290.942] CloseHandle (hObject=0x678) returned 1 [0290.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0290.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0290.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5698 [0290.943] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0290.943] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0290.943] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5a28 [0290.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0290.944] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0290.944] GetLastError () returned 0x0 [0290.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0290.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x3b6fa70, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0290.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0290.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.945] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0290.945] WriteFile (in: hFile=0x678, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe54, lpOverlapped=0x0) returned 1 [0290.946] CloseHandle (hObject=0x678) returned 1 [0290.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0290.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0290.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5a28 | out: hHeap=0x310000) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5698 | out: hHeap=0x310000) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0290.947] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4db0 | out: hHeap=0x310000) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b98 | out: hHeap=0x310000) returned 1 [0290.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2640 | out: hHeap=0x310000) returned 1 [0290.947] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0290.947] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0290.947] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.947] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0291.192] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.192] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0291.192] CloseHandle (hObject=0x678) returned 1 [0291.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a54d0 [0291.192] RmStartSession () returned 0x0 [0291.273] RmRegisterResources () returned 0x0 [0291.273] RmGetList () returned 0x0 [0291.398] RmShutdown () returned 0x0 [0291.475] RmEndSession () returned 0x0 [0291.476] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3b6fd40 | out: phKey=0x3b6fd40*=0x35da08) returned 1 [0291.476] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0291.477] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF", dwFileAttributes=0x220) returned 1 [0291.477] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0291.477] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3b6fba0*=0x2000) returned 1 [0291.477] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b6fc38 | out: lpFileSize=0x3b6fc38*=4024) returned 1 [0291.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0291.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589c020 [0292.283] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0292.283] ReadFile (in: hFile=0x554, lpBuffer=0x589c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3b6fc40, lpOverlapped=0x0 | out: lpBuffer=0x589c040*, lpNumberOfBytesRead=0x3b6fc40*=0xfb8, lpOverlapped=0x0) returned 1 [0292.283] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc28 | out: lpNewFilePointer=0x0) returned 1 [0292.283] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3b6fbb4*=0x2000) returned 1 [0292.283] WriteFile (in: hFile=0x554, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3b6fc44*=0x2000, lpOverlapped=0x0) returned 1 [0292.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc30 | out: lpNewFilePointer=0x0) returned 1 [0292.309] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3b6fc44*=0x200, lpOverlapped=0x0) returned 1 [0292.309] WriteFile (in: hFile=0x554, lpBuffer=0x3b6fbe0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x3b6fbe0*, lpNumberOfBytesWritten=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0292.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589c020 | out: hHeap=0x310000) returned 1 [0292.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0292.542] CloseHandle (hObject=0x554) returned 1 [0292.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0292.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3688 [0292.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4ee0 [0292.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c3740 [0292.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3688 | out: hHeap=0x310000) returned 1 [0292.542] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0292.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0292.543] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3b6fa14 | out: lpSystemTimeAsFileTime=0x3b6fa14) [0292.543] GetLastError () returned 0x0 [0292.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x3b6fa70, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0292.544] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.544] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0292.545] WriteFile (in: hFile=0x554, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3b6fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3b6fbb4*=0xe56, lpOverlapped=0x0) returned 1 [0292.546] CloseHandle (hObject=0x554) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c3740 | out: hHeap=0x310000) returned 1 [0292.546] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4ee0 | out: hHeap=0x310000) returned 1 [0292.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0292.547] CryptDestroyKey (hKey=0x35da08) returned 1 [0292.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a54d0 | out: hHeap=0x310000) returned 1 [0292.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306f00 | out: hHeap=0x310000) returned 1 [0292.547] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a268 | out: hHeap=0x310000) returned 1 [0292.547] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3b6fd74, lpCompletionKey=0x3b6fd78, lpOverlapped=0x3b6fd70) returned 1 [0292.547] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0292.547] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc48 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.547] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc44, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc44*=0x18, lpOverlapped=0x0) returned 1 [0292.549] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc50 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.549] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3b6fc38*=0x18, lpOverlapped=0x0) returned 1 [0292.549] CloseHandle (hObject=0x554) returned 1 [0292.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4ee0 [0292.549] RmStartSession () returned 0x0 [0293.367] RmRegisterResources () returned 0x0 [0293.367] RmGetList () returned 0x0 [0293.434] RmShutdown () Thread: id = 16 os_tid = 0x1104 [0068.626] GetLastError () returned 0x57 [0068.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x356480 [0068.626] SetLastError (dwErrCode=0x57) [0068.627] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0079.291] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0080.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0081.326] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0083.639] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0085.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0086.297] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0090.083] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0093.623] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0125.568] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0128.724] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0131.973] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0133.004] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 0 [0134.197] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0135.315] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0135.608] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.608] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0135.619] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.619] ReadFile (in: hFile=0x5b8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0135.619] CloseHandle (hObject=0x5b8) returned 1 [0135.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391eb8 [0135.619] RmStartSession () returned 0x0 [0136.947] RmRegisterResources () returned 0x0 [0136.951] RmGetList () returned 0x0 [0137.464] RmShutdown () returned 0x0 [0141.622] RmEndSession () returned 0x0 [0141.623] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x35da48) returned 1 [0141.623] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0141.623] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.624] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0141.624] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0141.624] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=74214) returned 1 [0141.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0141.624] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x63b5020 [0141.875] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0141.875] ReadFile (in: hFile=0x5e8, lpBuffer=0x63b5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x63b5040*, lpNumberOfBytesRead=0x3caf768*=0x121e6, lpOverlapped=0x0) returned 1 [0141.882] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0141.882] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.882] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.882] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.882] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.882] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.882] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.882] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.882] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.883] CryptEncrypt (in: hKey=0x35da48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0141.883] WriteFile (in: hFile=0x5e8, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0141.884] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0141.884] WriteFile (in: hFile=0x5e8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0141.884] WriteFile (in: hFile=0x5e8, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0141.884] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x63b5020 | out: hHeap=0x310000) returned 1 [0141.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0141.984] CloseHandle (hObject=0x5e8) returned 1 [0141.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0141.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0141.987] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365110 [0141.987] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.987] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1025\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0141.988] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0141.988] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398338 [0141.988] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] GetLastError () returned 0x0 [0141.988] SetLastError (dwErrCode=0x0) [0141.988] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0141.989] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.989] GetLastError () returned 0x0 [0141.989] SetLastError (dwErrCode=0x0) [0141.990] GetLastError () returned 0x0 [0141.990] SetLastError (dwErrCode=0x0) [0141.990] GetLastError () returned 0x0 [0141.990] SetLastError (dwErrCode=0x0) [0141.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365a98 [0141.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0141.990] GetLastError () returned 0x0 [0141.990] SetLastError (dwErrCode=0x0) [0141.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0141.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0141.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o3YUTB6kWZJFeepfmCEnbwyP1", cchWideChar=25, lpMultiByteStr=0x38c188, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o3YUTB6kWZJFeepfmCEnbwyP1", lpUsedDefaultChar=0x0) returned 25 [0141.990] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365a98 | out: hHeap=0x310000) returned 1 [0141.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bafca8 [0141.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5eb4088 [0141.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b0d0 [0141.990] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1025\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0141.991] WriteFile (in: hFile=0x5e8, lpBuffer=0x5eb4088*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x5eb4088*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6c, lpOverlapped=0x0) returned 1 [0141.992] CloseHandle (hObject=0x5e8) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b0d0 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5eb4088 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398338 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365110 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0141.992] CryptDestroyKey (hKey=0x35da48) returned 1 [0141.992] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391eb8 | out: hHeap=0x310000) returned 1 [0141.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3918a0 | out: hHeap=0x310000) returned 1 [0141.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3658b8 | out: hHeap=0x310000) returned 1 [0141.993] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0141.993] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0141.993] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.993] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0142.146] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.146] ReadFile (in: hFile=0x5e8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0142.146] CloseHandle (hObject=0x5e8) returned 1 [0142.146] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0142.147] RmStartSession () returned 0x0 [0142.148] RmRegisterResources () returned 0x0 [0142.473] RmGetList () returned 0x0 [0142.731] RmShutdown () returned 0x0 [0145.827] RmEndSession () returned 0x0 [0145.912] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261a88) returned 1 [0145.912] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0145.912] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x80) returned 1 [0145.912] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0145.912] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0145.913] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=4254) returned 1 [0145.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0145.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cfd020 [0145.933] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0145.933] ReadFile (in: hFile=0x518, lpBuffer=0x4cfd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x4cfd040*, lpNumberOfBytesRead=0x3caf768*=0x109e, lpOverlapped=0x0) returned 1 [0145.994] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0145.994] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0145.994] WriteFile (in: hFile=0x518, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0145.994] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0145.994] WriteFile (in: hFile=0x518, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0145.995] WriteFile (in: hFile=0x518, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0145.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cfd020 | out: hHeap=0x310000) returned 1 [0146.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0146.062] CloseHandle (hObject=0x518) returned 1 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c70 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0146.064] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0146.064] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1038\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398f30 [0146.064] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397de0 [0146.065] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eafa0 [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] GetLastError () returned 0x0 [0146.065] SetLastError (dwErrCode=0x0) [0146.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eafa0 | out: hHeap=0x310000) returned 1 [0146.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0146.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j2TQHz", cchWideChar=6, lpMultiByteStr=0x3caf5a0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j2TQHz", lpUsedDefaultChar=0x0) returned 6 [0146.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0146.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0146.065] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1038\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0146.066] WriteFile (in: hFile=0x518, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x3caf6dc*=0xe59, lpOverlapped=0x0) returned 1 [0146.067] CloseHandle (hObject=0x518) returned 1 [0146.067] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0146.067] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0146.067] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397de0 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398f30 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c70 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0146.068] CryptDestroyKey (hKey=0x5261a88) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c18 | out: hHeap=0x310000) returned 1 [0146.068] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19100 | out: hHeap=0x310000) returned 1 [0146.068] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0146.068] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0146.068] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.068] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0146.087] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.087] ReadFile (in: hFile=0x518, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0146.087] CloseHandle (hObject=0x518) returned 1 [0146.087] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0146.087] RmStartSession () returned 0x0 [0146.528] RmRegisterResources () returned 0x0 [0146.528] RmGetList () returned 0x0 [0147.172] RmShutdown () returned 0x0 [0149.187] RmEndSession () returned 0x0 [0149.188] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261748) returned 1 [0149.188] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0149.188] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0149.188] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0149.188] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0149.188] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=81482) returned 1 [0149.188] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0149.189] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x684f020 [0149.326] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0149.326] ReadFile (in: hFile=0x5c0, lpBuffer=0x684f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x684f040*, lpNumberOfBytesRead=0x3caf768*=0x13e4a, lpOverlapped=0x0) returned 1 [0149.328] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0149.328] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.328] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.328] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.328] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.328] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.328] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.328] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.328] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.328] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0149.329] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x5c0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x5c0, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0149.330] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x684f020 | out: hHeap=0x310000) returned 1 [0149.349] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0149.350] CloseHandle (hObject=0x5c0) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0149.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3560 [0149.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0149.352] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a35e8 [0149.352] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3560 | out: hHeap=0x310000) returned 1 [0149.352] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1049\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0149.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398188 [0149.353] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2bd0 [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.353] SetLastError (dwErrCode=0x0) [0149.353] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] GetLastError () returned 0x0 [0149.354] SetLastError (dwErrCode=0x0) [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bc00 [0149.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0149.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2bd0 | out: hHeap=0x310000) returned 1 [0149.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0149.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JuH0I4bPusHDEdIv", cchWideChar=16, lpMultiByteStr=0x38c4d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JuH0I4bPusHDEdIv", lpUsedDefaultChar=0x0) returned 16 [0149.354] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bc00 | out: hHeap=0x310000) returned 1 [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0149.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39df0 [0149.355] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1049\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0149.374] WriteFile (in: hFile=0x650, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x3caf6dc*=0xe63, lpOverlapped=0x0) returned 1 [0149.375] CloseHandle (hObject=0x650) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39df0 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398188 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a35e8 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0149.375] CryptDestroyKey (hKey=0x5261748) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x370b18 | out: hHeap=0x310000) returned 1 [0149.375] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18cf0 | out: hHeap=0x310000) returned 1 [0149.375] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0149.376] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0149.376] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.376] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0149.379] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.379] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0149.379] CloseHandle (hObject=0x650) returned 1 [0149.379] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1dc8 [0149.379] RmStartSession () returned 0x0 [0149.381] RmRegisterResources () returned 0x0 [0149.385] RmGetList () returned 0x0 [0149.846] RmShutdown () returned 0x0 [0150.853] RmEndSession () returned 0x0 [0150.854] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261a48) returned 1 [0150.854] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0150.854] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0150.855] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0150.855] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0150.855] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=201796) returned 1 [0150.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e58e0 [0150.855] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57f6020 [0150.874] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0150.874] ReadFile (in: hFile=0x650, lpBuffer=0x57f6040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x57f6040*, lpNumberOfBytesRead=0x3caf768*=0x31444, lpOverlapped=0x0) returned 1 [0150.939] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0150.939] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.939] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.939] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.939] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.939] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.939] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.940] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.940] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.941] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.942] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.942] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.943] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.943] CryptEncrypt (in: hKey=0x5261a48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e5900*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0150.943] WriteFile (in: hFile=0x650, lpBuffer=0x3e5900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3e5900*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0150.943] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0150.943] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0150.943] WriteFile (in: hFile=0x650, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0150.943] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57f6020 | out: hHeap=0x310000) returned 1 [0150.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e58e0 | out: hHeap=0x310000) returned 1 [0150.949] CloseHandle (hObject=0x650) returned 1 [0150.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0150.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2df0 [0150.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0150.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a31a8 [0150.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2df0 | out: hHeap=0x310000) returned 1 [0150.953] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\Client\\Parameterinfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0150.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980f8 [0150.957] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0150.957] GetLastError () returned 0x0 [0150.957] SetLastError (dwErrCode=0x0) [0150.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2f88 [0150.957] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.958] SetLastError (dwErrCode=0x0) [0150.958] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0150.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] GetLastError () returned 0x0 [0150.959] SetLastError (dwErrCode=0x0) [0150.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2f88 | out: hHeap=0x310000) returned 1 [0150.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0150.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0150.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c188, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0150.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0150.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0150.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bac288 [0150.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c39d78 [0150.960] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Client\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\client\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0150.960] WriteFile (in: hFile=0x650, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x3caf6dc*=0xe69, lpOverlapped=0x0) returned 1 [0150.961] CloseHandle (hObject=0x650) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39d78 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980f8 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a31a8 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0150.962] CryptDestroyKey (hKey=0x5261a48) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1dc8 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060908 | out: hHeap=0x310000) returned 1 [0150.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19560 | out: hHeap=0x310000) returned 1 [0150.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0150.962] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0150.962] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.962] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0150.965] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.965] ReadFile (in: hFile=0x650, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0150.965] CloseHandle (hObject=0x650) returned 1 [0150.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0150.966] RmStartSession () returned 0x0 [0150.967] RmRegisterResources () returned 0x0 [0150.972] RmGetList () returned 0x0 [0151.356] RmShutdown () returned 0x0 [0155.622] RmEndSession () returned 0x0 [0156.119] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261688) returned 1 [0156.119] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0156.119] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico", dwFileAttributes=0x80) returned 1 [0156.120] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0156.120] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0156.120] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=894) returned 1 [0156.120] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c94018 [0156.121] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590c020 [0156.141] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0156.142] ReadFile (in: hFile=0x650, lpBuffer=0x590c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x590c040*, lpNumberOfBytesRead=0x3caf768*=0x37e, lpOverlapped=0x0) returned 1 [0156.183] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0156.183] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c94020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c94020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0156.183] WriteFile (in: hFile=0x650, lpBuffer=0x5c94020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5c94020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0156.183] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0156.183] WriteFile (in: hFile=0x650, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0156.184] WriteFile (in: hFile=0x650, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0156.184] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590c020 | out: hHeap=0x310000) returned 1 [0156.191] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94018 | out: hHeap=0x310000) returned 1 [0156.191] CloseHandle (hObject=0x650) returned 1 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0798 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0090 [0156.851] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0156.851] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0156.851] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399820 [0156.852] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] GetLastError () returned 0x0 [0156.852] SetLastError (dwErrCode=0x0) [0156.852] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0156.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0156.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eOdNRgPs7m", cchWideChar=10, lpMultiByteStr=0x3caf5a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eOdNRgPs7m", lpUsedDefaultChar=0x0) returned 10 [0156.853] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0156.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0156.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0156.853] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0156.854] WriteFile (in: hFile=0x678, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x3caf6dc*=0xe5d, lpOverlapped=0x0) returned 1 [0156.854] CloseHandle (hObject=0x678) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399820 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0090 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0156.855] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0156.856] CryptDestroyKey (hKey=0x5261688) returned 1 [0156.856] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0156.856] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060aa8 | out: hHeap=0x310000) returned 1 [0156.856] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365908 | out: hHeap=0x310000) returned 1 [0156.856] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0156.856] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0156.856] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.857] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0156.858] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.858] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0156.858] CloseHandle (hObject=0x678) returned 1 [0156.858] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0156.858] RmStartSession () returned 0x0 [0157.504] RmRegisterResources () returned 0x0 [0157.508] RmGetList () returned 0x0 [0158.887] RmShutdown () returned 0x0 [0159.596] RmEndSession () returned 0x0 [0159.597] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261888) returned 1 [0159.597] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0159.597] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x80) returned 1 [0159.598] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0159.598] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0159.598] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=272046) returned 1 [0159.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc4670 [0159.598] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6e1d020 [0160.123] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0160.123] ReadFile (in: hFile=0x678, lpBuffer=0x6e1d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6e1d040*, lpNumberOfBytesRead=0x3caf768*=0x426ae, lpOverlapped=0x0) returned 1 [0160.435] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0160.435] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.436] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.441] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.441] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.441] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.441] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.442] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.442] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.442] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.442] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.442] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.442] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.442] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.442] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.443] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.443] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.444] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.444] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.445] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.445] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.446] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.446] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.447] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.447] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.447] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0160.447] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0160.447] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0160.447] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0160.448] WriteFile (in: hFile=0x678, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0160.448] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6e1d020 | out: hHeap=0x310000) returned 1 [0161.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc4670 | out: hHeap=0x310000) returned 1 [0161.156] CloseHandle (hObject=0x678) returned 1 [0161.162] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0161.162] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0161.162] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2170 [0161.162] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f09f0 [0161.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0161.162] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\ParameterInfo.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.163] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2240 [0161.163] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0161.163] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0161.163] GetLastError () returned 0x0 [0161.163] SetLastError (dwErrCode=0x0) [0161.163] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a42a8 [0161.163] GetLastError () returned 0x0 [0161.163] SetLastError (dwErrCode=0x0) [0161.163] GetLastError () returned 0x0 [0161.163] SetLastError (dwErrCode=0x0) [0161.163] GetLastError () returned 0x0 [0161.163] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.164] GetLastError () returned 0x0 [0161.164] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0161.165] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] GetLastError () returned 0x0 [0161.165] SetLastError (dwErrCode=0x0) [0161.165] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a42a8 | out: hHeap=0x310000) returned 1 [0161.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0161.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0161.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x38c390, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asZJGyY6zFo1elxK4hBU7cY", lpUsedDefaultChar=0x0) returned 23 [0161.165] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0161.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0161.166] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0161.166] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0161.166] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0161.167] WriteFile (in: hFile=0x678, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6a, lpOverlapped=0x0) returned 1 [0161.167] CloseHandle (hObject=0x678) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2240 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2170 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0161.168] CryptDestroyKey (hKey=0x5261888) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a21d8 | out: hHeap=0x310000) returned 1 [0161.168] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5ad0 | out: hHeap=0x310000) returned 1 [0161.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0161.168] CreateFileW (lpFileName="C:\\\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0161.170] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.170] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0161.238] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.238] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0161.238] CloseHandle (hObject=0x678) returned 1 [0161.239] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3981d0 [0161.239] RmStartSession () returned 0x0 [0162.210] RmRegisterResources () returned 0x0 [0162.214] RmGetList () returned 0x0 [0163.489] RmShutdown () returned 0x0 [0166.836] RmEndSession () returned 0x0 [0166.837] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261608) returned 1 [0166.837] GetFileAttributesW (lpFileName="C:\\\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0166.837] SetFileAttributesW (lpFileName="C:\\\\Logs\\Application.evtx", dwFileAttributes=0x20) returned 1 [0166.838] CreateFileW (lpFileName="C:\\\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0166.838] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0166.838] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0166.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc4670 [0166.838] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6e96020 [0167.605] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0167.605] ReadFile (in: hFile=0x678, lpBuffer=0x6e96040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6e96040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0167.634] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0167.634] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.634] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.634] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.634] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.635] CryptEncrypt (in: hKey=0x5261608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc4680*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0167.635] WriteFile (in: hFile=0x678, lpBuffer=0x4bc4680*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4bc4680*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0167.636] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0167.636] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0167.636] WriteFile (in: hFile=0x678, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0167.636] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6e96020 | out: hHeap=0x310000) returned 1 [0167.656] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc4670 | out: hHeap=0x310000) returned 1 [0167.656] CloseHandle (hObject=0x678) returned 1 [0167.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0167.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3993a8 [0167.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0167.658] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399400 [0167.658] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3993a8 | out: hHeap=0x310000) returned 1 [0167.658] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="C:\\\\Logs\\Application.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\application.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0167.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b10 [0167.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0167.659] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0167.659] GetLastError () returned 0x0 [0167.659] SetLastError (dwErrCode=0x0) [0167.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3c48 [0167.659] GetLastError () returned 0x0 [0167.659] SetLastError (dwErrCode=0x0) [0167.659] GetLastError () returned 0x0 [0167.659] SetLastError (dwErrCode=0x0) [0167.659] GetLastError () returned 0x0 [0167.659] SetLastError (dwErrCode=0x0) [0167.659] GetLastError () returned 0x0 [0167.659] SetLastError (dwErrCode=0x0) [0167.659] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] GetLastError () returned 0x0 [0167.660] SetLastError (dwErrCode=0x0) [0167.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3c48 | out: hHeap=0x310000) returned 1 [0167.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0167.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i8hSHAmSXv4", cchWideChar=11, lpMultiByteStr=0x3caf5a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i8hSHAmSXv4", lpUsedDefaultChar=0x0) returned 11 [0167.660] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0167.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0167.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0167.660] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0167.661] WriteFile (in: hFile=0x678, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x3caf6dc*=0xe5e, lpOverlapped=0x0) returned 1 [0167.662] CloseHandle (hObject=0x678) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399400 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0167.662] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0167.662] CryptDestroyKey (hKey=0x5261608) returned 1 [0167.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3981d0 | out: hHeap=0x310000) returned 1 [0167.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0167.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18b10 | out: hHeap=0x310000) returned 1 [0167.663] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0167.663] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0167.663] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.663] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0167.695] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.695] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0167.695] CloseHandle (hObject=0x678) returned 1 [0167.695] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0c48 [0167.695] RmStartSession () returned 0x0 [0167.845] RmRegisterResources () returned 0x0 [0167.849] RmGetList () returned 0x0 [0170.058] RmShutdown () returned 0x0 [0175.405] RmEndSession () returned 0x0 [0175.406] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5260c08) returned 1 [0175.406] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0175.407] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0175.407] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0175.407] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0175.407] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0175.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x51c9a70 [0175.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x669a020 [0175.788] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0175.788] ReadFile (in: hFile=0x678, lpBuffer=0x669a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x669a040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0175.801] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.801] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.801] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.802] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.802] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.802] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.802] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.802] CryptEncrypt (in: hKey=0x5260c08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x51c9a80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0175.802] WriteFile (in: hFile=0x678, lpBuffer=0x51c9a80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x51c9a80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0175.802] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0175.802] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0175.802] WriteFile (in: hFile=0x678, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0175.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x669a020 | out: hHeap=0x310000) returned 1 [0176.085] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9a70 | out: hHeap=0x310000) returned 1 [0176.086] CloseHandle (hObject=0x678) returned 1 [0176.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0176.088] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3d58 [0176.089] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0176.089] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4a18 [0176.089] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3d58 | out: hHeap=0x310000) returned 1 [0176.089] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0176.099] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0176.099] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0176.099] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] GetLastError () returned 0x0 [0176.100] SetLastError (dwErrCode=0x0) [0176.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0176.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0176.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x3caf5a0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0176.100] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0176.100] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0176.101] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397528 [0176.101] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0176.102] WriteFile (in: hFile=0x678, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x3caf6dc*=0xe5b, lpOverlapped=0x0) returned 1 [0176.102] CloseHandle (hObject=0x678) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4a18 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0176.103] CryptDestroyKey (hKey=0x5260c08) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0c48 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0176.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e58a0 | out: hHeap=0x310000) returned 1 [0176.103] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0176.103] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0176.104] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.104] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0176.118] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.118] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0176.119] CloseHandle (hObject=0x678) returned 1 [0176.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0176.119] RmStartSession () returned 0x0 [0176.123] RmRegisterResources () returned 0x0 [0176.123] RmGetList () returned 0x0 [0176.506] RmShutdown () returned 0x0 [0177.701] RmEndSession () returned 0x0 [0177.902] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261948) returned 1 [0177.902] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0177.902] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0177.902] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0177.902] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0177.902] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0177.902] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0177.903] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6665020 [0177.921] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0177.921] ReadFile (in: hFile=0x678, lpBuffer=0x6665040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6665040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0177.963] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.963] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.963] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.963] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.963] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.963] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.963] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.964] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.964] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.964] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0177.964] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0177.964] WriteFile (in: hFile=0x678, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0177.965] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6665020 | out: hHeap=0x310000) returned 1 [0177.969] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0177.969] CloseHandle (hObject=0x678) returned 1 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5323408 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322ce8 [0177.972] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5323408 | out: hHeap=0x310000) returned 1 [0177.972] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0177.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0177.972] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.973] SetLastError (dwErrCode=0x0) [0177.973] GetLastError () returned 0x0 [0177.974] SetLastError (dwErrCode=0x0) [0177.974] GetLastError () returned 0x0 [0177.974] SetLastError (dwErrCode=0x0) [0177.974] GetLastError () returned 0x0 [0177.974] SetLastError (dwErrCode=0x0) [0177.974] GetLastError () returned 0x0 [0177.974] SetLastError (dwErrCode=0x0) [0177.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0177.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0177.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cTrvvrwpmgtguVI", cchWideChar=15, lpMultiByteStr=0x3caf5a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cTrvvrwpmgtguVI", lpUsedDefaultChar=0x0) returned 15 [0177.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0177.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0177.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0177.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0177.974] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0177.975] WriteFile (in: hFile=0x678, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3caf6dc*=0xe62, lpOverlapped=0x0) returned 1 [0177.976] CloseHandle (hObject=0x678) returned 1 [0177.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0177.976] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322ce8 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0177.977] CryptDestroyKey (hKey=0x5261948) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea368 | out: hHeap=0x310000) returned 1 [0177.977] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6830 | out: hHeap=0x310000) returned 1 [0177.977] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0177.977] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0177.977] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.977] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0178.115] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.115] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0178.115] CloseHandle (hObject=0x678) returned 1 [0178.115] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0178.115] RmStartSession () returned 0x0 [0178.183] RmRegisterResources () returned 0x0 [0178.187] RmGetList () returned 0x0 [0178.688] RmShutdown () returned 0x0 [0179.678] RmEndSession () returned 0x0 [0179.679] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261188) returned 1 [0179.680] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0179.680] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x20) returned 1 [0179.680] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0179.680] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0179.680] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0179.680] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3f1f08 [0179.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6660020 [0179.922] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0179.922] ReadFile (in: hFile=0x678, lpBuffer=0x6660040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6660040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0179.927] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0179.927] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.927] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.928] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.928] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.929] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x3f1f20*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0179.929] WriteFile (in: hFile=0x678, lpBuffer=0x3f1f20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3f1f20*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0179.929] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0179.929] WriteFile (in: hFile=0x678, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0179.929] WriteFile (in: hFile=0x678, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0179.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6660020 | out: hHeap=0x310000) returned 1 [0179.995] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f1f08 | out: hHeap=0x310000) returned 1 [0179.995] CloseHandle (hObject=0x678) returned 1 [0179.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0179.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0179.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0798 [0179.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0179.998] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0179.998] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0179.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0b58 [0179.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0179.999] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0179.999] SetLastError (dwErrCode=0x0) [0179.999] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b650 [0180.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0180.000] GetLastError () returned 0x0 [0180.000] SetLastError (dwErrCode=0x0) [0180.000] GetLastError () returned 0x0 [0180.001] SetLastError (dwErrCode=0x0) [0180.001] GetLastError () returned 0x0 [0180.001] SetLastError (dwErrCode=0x0) [0180.001] GetLastError () returned 0x0 [0180.001] SetLastError (dwErrCode=0x0) [0180.001] GetLastError () returned 0x0 [0180.001] SetLastError (dwErrCode=0x0) [0180.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0180.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0180.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LEa8akVxyvJo8s5UpDdBd", cchWideChar=21, lpMultiByteStr=0x38c480, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LEa8akVxyvJo8s5UpDdBd", lpUsedDefaultChar=0x0) returned 21 [0180.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0180.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0180.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bab400 [0180.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0180.001] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0180.002] WriteFile (in: hFile=0x678, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x3caf6dc*=0xe68, lpOverlapped=0x0) returned 1 [0180.003] CloseHandle (hObject=0x678) returned 1 [0180.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0180.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0180.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0180.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0180.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0180.005] CryptDestroyKey (hKey=0x5261188) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39af68 | out: hHeap=0x310000) returned 1 [0180.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e68d0 | out: hHeap=0x310000) returned 1 [0180.005] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0180.005] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0180.005] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.005] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0180.016] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.016] ReadFile (in: hFile=0x678, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0180.016] CloseHandle (hObject=0x678) returned 1 [0180.016] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f09f0 [0180.016] RmStartSession () returned 0x0 [0180.161] RmRegisterResources () returned 0x0 [0180.161] RmGetList () returned 0x0 [0181.711] RmShutdown () returned 0x0 [0185.824] RmEndSession () returned 0x0 [0186.239] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261648) returned 1 [0186.239] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0186.239] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0186.239] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0186.239] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0186.239] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0186.239] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2038 [0186.240] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cff020 [0186.257] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0186.257] ReadFile (in: hFile=0x660, lpBuffer=0x4cff040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x4cff040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0186.322] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0186.322] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.322] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.323] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.323] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.323] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.323] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.326] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.326] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.327] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.327] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.327] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.327] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.327] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.327] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.327] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.327] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.327] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd2040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0186.327] WriteFile (in: hFile=0x660, lpBuffer=0x5bd2040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5bd2040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0186.723] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0186.723] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0186.724] WriteFile (in: hFile=0x660, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0186.724] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cff020 | out: hHeap=0x310000) returned 1 [0187.030] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2038 | out: hHeap=0x310000) returned 1 [0187.030] CloseHandle (hObject=0x660) returned 1 [0187.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0187.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0187.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0888 [0187.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0187.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0187.033] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0187.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0187.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0187.033] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0187.033] GetLastError () returned 0x0 [0187.033] SetLastError (dwErrCode=0x0) [0187.033] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0187.033] GetLastError () returned 0x0 [0187.033] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] GetLastError () returned 0x0 [0187.034] SetLastError (dwErrCode=0x0) [0187.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0187.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x3caf5a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K5peP9WcLDHI", lpUsedDefaultChar=0x0) returned 12 [0187.034] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0187.034] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0187.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0187.035] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0187.035] WriteFile (in: hFile=0x660, lpBuffer=0x5410238*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x5410238*, lpNumberOfBytesWritten=0x3caf6dc*=0xe5f, lpOverlapped=0x0) returned 1 [0187.036] CloseHandle (hObject=0x660) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0888 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0187.037] CryptDestroyKey (hKey=0x5261648) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0187.037] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6ce0 | out: hHeap=0x310000) returned 1 [0187.037] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0187.037] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0187.037] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.037] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0187.040] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.040] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0187.040] CloseHandle (hObject=0x660) returned 1 [0187.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136d38 [0187.040] RmStartSession () returned 0x0 [0187.043] RmRegisterResources () returned 0x0 [0187.047] RmGetList () returned 0x0 [0187.574] RmShutdown () returned 0x0 [0190.717] RmEndSession () returned 0x0 [0190.718] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261508) returned 1 [0190.718] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0190.718] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0190.718] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0190.718] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0190.718] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=69632) returned 1 [0190.718] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0190.719] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6997020 [0190.871] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0190.871] ReadFile (in: hFile=0x660, lpBuffer=0x6997040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6997040*, lpNumberOfBytesRead=0x3caf768*=0x11000, lpOverlapped=0x0) returned 1 [0190.911] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.911] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.911] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.912] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.912] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.912] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.912] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.912] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0190.912] WriteFile (in: hFile=0x660, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0190.912] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0190.912] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0190.912] WriteFile (in: hFile=0x660, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0190.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6997020 | out: hHeap=0x310000) returned 1 [0190.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0190.917] CloseHandle (hObject=0x660) returned 1 [0190.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0190.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51cef70 [0190.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136f60 [0190.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xc0) returned 0x51ce6d8 [0190.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cef70 | out: hHeap=0x310000) returned 1 [0190.920] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0190.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136a58 [0190.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0190.921] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.921] SetLastError (dwErrCode=0x0) [0190.921] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0190.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] GetLastError () returned 0x0 [0190.922] SetLastError (dwErrCode=0x0) [0190.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bacfd8 [0190.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0190.922] GetLastError () returned 0x0 [0190.923] SetLastError (dwErrCode=0x0) [0190.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0190.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0190.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0190.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c390, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0190.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bacfd8 | out: hHeap=0x310000) returned 1 [0190.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5410238 [0190.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540d6a0 [0190.923] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3980b0 [0190.923] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0190.924] WriteFile (in: hFile=0x660, lpBuffer=0x540d6a0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x540d6a0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6c, lpOverlapped=0x0) returned 1 [0190.924] CloseHandle (hObject=0x660) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3980b0 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5410238 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136a58 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ce6d8 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136f60 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0190.925] CryptDestroyKey (hKey=0x5261508) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136d38 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391468 | out: hHeap=0x310000) returned 1 [0190.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3659f8 | out: hHeap=0x310000) returned 1 [0190.925] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0190.925] CreateFileW (lpFileName="C:\\\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0190.925] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.926] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0190.962] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.963] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0190.963] CloseHandle (hObject=0x660) returned 1 [0190.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0190.963] RmStartSession () returned 0x0 [0190.967] RmRegisterResources () returned 0x0 [0190.970] RmGetList () returned 0x0 [0191.941] RmShutdown () returned 0x0 [0197.139] RmEndSession () returned 0x0 [0197.140] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x52618c8) returned 1 [0197.140] GetFileAttributesW (lpFileName="C:\\\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0197.140] SetFileAttributesW (lpFileName="C:\\\\Logs\\Security.evtx", dwFileAttributes=0x20) returned 1 [0197.141] CreateFileW (lpFileName="C:\\\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0197.141] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0197.141] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=1118208) returned 1 [0197.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b7ef88 [0197.141] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76fa020 [0197.474] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0197.474] ReadFile (in: hFile=0x660, lpBuffer=0x76fa040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x76fa040*, lpNumberOfBytesRead=0x3caf768*=0x100000, lpOverlapped=0x0) returned 1 [0197.588] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0197.588] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.588] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.589] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.589] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.590] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.590] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.591] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.591] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.592] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.592] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.593] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.594] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.594] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.595] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.595] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.596] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.596] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.597] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.597] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.598] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.598] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.599] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.599] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.600] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.600] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.600] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.600] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.600] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.600] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.601] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.601] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.602] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.602] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.603] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.604] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.604] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.610] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.610] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.610] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.610] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b7efa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x4b7efa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b7efa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0197.611] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0197.611] WriteFile (in: hFile=0x660, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0197.612] WriteFile (in: hFile=0x660, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0197.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76fa020 | out: hHeap=0x310000) returned 1 [0197.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b7ef88 | out: hHeap=0x310000) returned 1 [0197.777] CloseHandle (hObject=0x660) returned 1 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3999d8 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399718 [0197.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3999d8 | out: hHeap=0x310000) returned 1 [0197.778] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="C:\\\\Logs\\Security.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\security.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b8f0 [0197.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0197.778] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0197.778] GetLastError () returned 0x0 [0197.778] SetLastError (dwErrCode=0x0) [0197.779] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc2b8 [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.779] SetLastError (dwErrCode=0x0) [0197.779] GetLastError () returned 0x0 [0197.780] SetLastError (dwErrCode=0x0) [0197.780] GetLastError () returned 0x0 [0197.780] SetLastError (dwErrCode=0x0) [0197.780] GetLastError () returned 0x0 [0197.780] SetLastError (dwErrCode=0x0) [0197.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b538 [0197.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc2b8 | out: hHeap=0x310000) returned 1 [0197.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x38c3e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lRTaZqgzay52GZY8", lpUsedDefaultChar=0x0) returned 16 [0197.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b538 | out: hHeap=0x310000) returned 1 [0197.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0197.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0197.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3981d0 [0197.780] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0197.781] WriteFile (in: hFile=0x660, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3caf6dc*=0xe63, lpOverlapped=0x0) returned 1 [0197.782] CloseHandle (hObject=0x660) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3981d0 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8f0 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399718 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0197.782] CryptDestroyKey (hKey=0x52618c8) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0197.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b449e8 | out: hHeap=0x310000) returned 1 [0197.782] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0197.782] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0197.782] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.782] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0197.784] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.784] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0197.784] CloseHandle (hObject=0x660) returned 1 [0197.784] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b5f80 [0197.784] RmStartSession () returned 0x0 [0197.787] RmRegisterResources () returned 0x0 [0197.792] RmGetList () returned 0x0 [0198.787] RmShutdown () returned 0x0 [0203.777] RmEndSession () returned 0x0 [0203.778] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x35dcc8) returned 1 [0203.778] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0203.778] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", dwFileAttributes=0x20) returned 0 [0203.778] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.779] CryptDestroyKey (hKey=0x35dcc8) returned 1 [0203.779] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b5f80 | out: hHeap=0x310000) returned 1 [0203.779] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92778 | out: hHeap=0x310000) returned 1 [0203.779] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07c40 | out: hHeap=0x310000) returned 1 [0203.779] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0203.779] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0203.779] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.779] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0203.831] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.831] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0203.832] CloseHandle (hObject=0x660) returned 1 [0203.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92cb8 [0203.832] RmStartSession () returned 0x0 [0203.834] RmRegisterResources () returned 0x0 [0203.839] RmGetList () returned 0x0 [0207.338] RmShutdown () returned 0x0 [0209.917] RmEndSession () returned 0x0 [0210.239] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x52612c8) returned 1 [0210.239] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0210.239] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0210.239] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.239] CryptDestroyKey (hKey=0x52612c8) returned 1 [0210.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92cb8 | out: hHeap=0x310000) returned 1 [0210.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92b68 | out: hHeap=0x310000) returned 1 [0210.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07a10 | out: hHeap=0x310000) returned 1 [0210.239] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0210.239] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0210.240] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.240] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0210.241] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.241] ReadFile (in: hFile=0x660, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0210.241] CloseHandle (hObject=0x660) returned 1 [0210.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c92ac0 [0210.241] RmStartSession () returned 0x0 [0210.349] RmRegisterResources () returned 0x0 [0210.349] RmGetList () returned 0x0 [0212.163] RmShutdown () returned 0x0 [0214.769] RmEndSession () returned 0x0 [0214.931] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261ac8) returned 1 [0214.931] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0214.931] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml", dwFileAttributes=0x20) returned 0 [0214.931] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.931] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0214.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92ac0 | out: hHeap=0x310000) returned 1 [0214.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0214.931] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5b50 | out: hHeap=0x310000) returned 1 [0214.931] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0214.931] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0214.932] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.932] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0214.963] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.963] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0214.963] CloseHandle (hObject=0x508) returned 1 [0214.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0214.963] RmStartSession () returned 0x0 [0214.966] RmRegisterResources () returned 0x0 [0214.967] RmGetList () returned 0x0 [0215.017] RmShutdown () returned 0x0 [0215.346] RmEndSession () returned 0x0 [0215.347] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261408) returned 1 [0215.347] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0215.347] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml", dwFileAttributes=0x20) returned 0 [0215.347] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.347] CryptDestroyKey (hKey=0x5261408) returned 1 [0215.347] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0215.347] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb0b0 | out: hHeap=0x310000) returned 1 [0215.348] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6280 | out: hHeap=0x310000) returned 1 [0215.348] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0215.348] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0215.348] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.348] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0215.353] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.353] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0215.353] CloseHandle (hObject=0x508) returned 1 [0215.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0215.353] RmStartSession () returned 0x0 [0215.357] RmRegisterResources () returned 0x0 [0220.451] RmGetList () returned 0x0 [0221.781] RmShutdown () returned 0x0 [0226.373] RmEndSession () returned 0x0 [0226.374] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261548) returned 1 [0226.374] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0226.374] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml", dwFileAttributes=0x20) returned 0 [0226.374] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.374] CryptDestroyKey (hKey=0x5261548) returned 1 [0226.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0226.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb930 | out: hHeap=0x310000) returned 1 [0226.374] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a60a0 | out: hHeap=0x310000) returned 1 [0226.374] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0226.374] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0226.375] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.375] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0226.376] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.376] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0226.376] CloseHandle (hObject=0x508) returned 1 [0226.376] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0226.376] RmStartSession () returned 0x0 [0226.380] RmRegisterResources () returned 0x0 [0226.381] RmGetList () returned 0x0 [0228.383] RmShutdown () returned 0x0 [0230.472] RmEndSession () returned 0x0 [0230.473] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x52618c8) returned 1 [0230.473] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0230.473] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", dwFileAttributes=0x20) returned 0 [0230.473] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.473] CryptDestroyKey (hKey=0x52618c8) returned 1 [0230.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0230.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c4e0 | out: hHeap=0x310000) returned 1 [0230.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14c90 | out: hHeap=0x310000) returned 1 [0230.474] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0230.474] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0230.474] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.474] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0230.478] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.478] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0230.478] CloseHandle (hObject=0x508) returned 1 [0230.478] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0bd0 [0230.478] RmStartSession () returned 0x0 [0230.482] RmRegisterResources () returned 0x0 [0230.482] RmGetList () returned 0x0 [0231.140] RmShutdown () returned 0x0 [0232.911] RmEndSession () returned 0x0 [0232.985] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x52618c8) returned 1 [0232.985] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0232.985] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado28.tlb", dwFileAttributes=0x20) returned 0 [0232.985] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.985] CryptDestroyKey (hKey=0x52618c8) returned 1 [0232.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0bd0 | out: hHeap=0x310000) returned 1 [0232.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a410 | out: hHeap=0x310000) returned 1 [0232.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19060 | out: hHeap=0x310000) returned 1 [0232.985] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0232.985] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0232.985] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.986] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0233.018] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.018] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0233.018] CloseHandle (hObject=0x508) returned 1 [0233.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0233.018] RmStartSession () returned 0x0 [0233.021] RmRegisterResources () returned 0x0 [0233.022] RmGetList () returned 0x0 [0233.162] RmShutdown () returned 0x0 [0233.508] RmEndSession () returned 0x0 [0233.508] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261088) returned 1 [0233.509] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0233.509] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", dwFileAttributes=0x20) returned 0 [0233.509] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.509] CryptDestroyKey (hKey=0x5261088) returned 1 [0233.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0233.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571180 | out: hHeap=0x310000) returned 1 [0233.509] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572bf8 | out: hHeap=0x310000) returned 1 [0233.509] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0233.509] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0233.509] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.510] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0233.610] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.610] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0233.611] CloseHandle (hObject=0x508) returned 1 [0233.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0233.611] RmStartSession () returned 0x0 [0233.612] RmRegisterResources () returned 0x0 [0233.612] RmGetList () returned 0x0 [0233.696] RmShutdown () returned 0x0 [0234.034] RmEndSession () returned 0x0 [0234.034] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261088) returned 1 [0234.035] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0234.035] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", dwFileAttributes=0x20) returned 0 [0234.035] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.035] CryptDestroyKey (hKey=0x5261088) returned 1 [0234.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0234.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0234.035] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572c48 | out: hHeap=0x310000) returned 1 [0234.035] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0234.035] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0234.035] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.035] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0234.135] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.135] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0234.135] CloseHandle (hObject=0x508) returned 1 [0234.135] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0234.135] RmStartSession () returned 0x0 [0234.138] RmRegisterResources () returned 0x0 [0234.139] RmGetList () returned 0x0 [0234.263] RmShutdown () returned 0x0 [0234.849] RmEndSession () returned 0x0 [0234.942] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5260bc8) returned 1 [0234.942] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0234.942] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui", dwFileAttributes=0x20) returned 0 [0234.943] CreateFileW (lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.943] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0234.943] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0234.943] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3bc0 | out: hHeap=0x310000) returned 1 [0234.943] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572d38 | out: hHeap=0x310000) returned 1 [0234.943] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0234.943] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0234.943] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.943] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0234.944] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.944] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0234.944] CloseHandle (hObject=0x55c) returned 1 [0234.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0234.945] RmStartSession () returned 0x0 [0234.948] RmRegisterResources () returned 0x0 [0234.948] RmGetList () returned 0x0 [0236.932] RmShutdown () returned 0x0 [0237.803] RmEndSession () returned 0x0 [0238.070] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5260f08) returned 1 [0238.070] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0238.070] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0238.071] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0238.071] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0238.071] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=18677760) returned 1 [0238.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b5cf70 [0238.071] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56f1020 [0238.090] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0238.090] ReadFile (in: hFile=0x55c, lpBuffer=0x56f1040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x56f1040*, lpNumberOfBytesRead=0x3caf768*=0x100000, lpOverlapped=0x0) returned 1 [0238.280] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0238.280] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.280] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.281] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.281] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.282] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.282] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.283] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.283] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.284] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.284] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.285] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.285] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.286] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.286] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.287] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.287] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.288] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.288] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.288] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.288] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.288] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.288] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.289] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.289] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.290] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.290] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.291] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.291] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.292] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.292] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.293] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.293] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.294] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.294] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.295] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.295] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.296] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.296] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.297] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.297] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b5cf80*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0238.298] WriteFile (in: hFile=0x55c, lpBuffer=0x4b5cf80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b5cf80*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0238.298] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0238.299] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0238.333] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0238.334] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56f1020 | out: hHeap=0x310000) returned 1 [0238.824] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b5cf70 | out: hHeap=0x310000) returned 1 [0238.824] CloseHandle (hObject=0x55c) returned 1 [0238.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0238.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2e20 [0238.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0238.825] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0238.825] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0238.825] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.bdcddcbaad"), dwFlags=0x1) returned 1 [0238.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0238.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0238.827] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.827] SetLastError (dwErrCode=0x0) [0238.827] GetLastError () returned 0x0 [0238.828] SetLastError (dwErrCode=0x0) [0238.828] GetLastError () returned 0x0 [0238.828] SetLastError (dwErrCode=0x0) [0238.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0238.828] GetLastError () returned 0x0 [0238.828] SetLastError (dwErrCode=0x0) [0238.828] GetLastError () returned 0x0 [0238.828] SetLastError (dwErrCode=0x0) [0238.828] GetLastError () returned 0x0 [0238.828] SetLastError (dwErrCode=0x0) [0238.828] GetLastError () returned 0x0 [0238.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0238.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0238.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x38c480, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LUpoh1S64gDKMZE4Tnpz2A", lpUsedDefaultChar=0x0) returned 22 [0238.828] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b490 | out: hHeap=0x310000) returned 1 [0238.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0238.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0238.828] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0238.828] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0238.829] WriteFile (in: hFile=0x55c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe69, lpOverlapped=0x0) returned 1 [0238.829] CloseHandle (hObject=0x55c) returned 1 [0238.829] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0238.830] CryptDestroyKey (hKey=0x5260f08) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3098 | out: hHeap=0x310000) returned 1 [0238.830] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55720b8 | out: hHeap=0x310000) returned 1 [0238.830] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0238.830] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0238.830] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.830] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0238.840] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.840] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0238.840] CloseHandle (hObject=0x55c) returned 1 [0238.840] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0238.840] RmStartSession () returned 0x0 [0238.842] RmRegisterResources () returned 0x0 [0238.846] RmGetList () returned 0x0 [0240.089] RmShutdown () returned 0x0 [0240.943] RmEndSession () returned 0x0 [0240.945] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5260f08) returned 1 [0240.945] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0240.945] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties", dwFileAttributes=0x20) returned 1 [0240.945] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0240.945] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0240.945] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=5712) returned 1 [0240.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0240.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ef020 [0241.327] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0241.327] ReadFile (in: hFile=0x55c, lpBuffer=0x49ef040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x49ef040*, lpNumberOfBytesRead=0x3caf768*=0x1650, lpOverlapped=0x0) returned 1 [0241.329] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0241.329] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0241.329] WriteFile (in: hFile=0x55c, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0241.329] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0241.329] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0241.329] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0241.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ef020 | out: hHeap=0x310000) returned 1 [0241.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0241.398] CloseHandle (hObject=0x55c) returned 1 [0241.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0241.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dbf30 [0241.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0241.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc660 [0241.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0241.398] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391c48 [0241.399] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0241.399] GetLastError () returned 0x0 [0241.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0241.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x38c188, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", lpUsedDefaultChar=0x0) returned 28 [0241.399] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e59d0 | out: hHeap=0x310000) returned 1 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0241.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0241.399] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0241.399] WriteFile (in: hFile=0x55c, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6f, lpOverlapped=0x0) returned 1 [0241.400] CloseHandle (hObject=0x55c) returned 1 [0241.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0241.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0241.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc660 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0241.401] CryptDestroyKey (hKey=0x5260f08) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570c28 | out: hHeap=0x310000) returned 1 [0241.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572608 | out: hHeap=0x310000) returned 1 [0241.401] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0241.401] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0241.401] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.401] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0241.423] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.423] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0241.423] CloseHandle (hObject=0x55c) returned 1 [0241.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0241.424] RmStartSession () returned 0x0 [0241.426] RmRegisterResources () returned 0x0 [0241.426] RmGetList () returned 0x0 [0241.471] RmShutdown () returned 0x0 [0241.826] RmEndSession () returned 0x0 [0242.067] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261448) returned 1 [0242.067] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0242.067] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif", dwFileAttributes=0x20) returned 1 [0242.067] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0242.067] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0242.067] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=12250) returned 1 [0242.067] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0242.068] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2f020 [0242.085] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0242.085] ReadFile (in: hFile=0x55c, lpBuffer=0x4c2f040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x4c2f040*, lpNumberOfBytesRead=0x3caf768*=0x2fda, lpOverlapped=0x0) returned 1 [0242.111] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0242.111] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0242.111] WriteFile (in: hFile=0x55c, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0242.112] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0242.112] WriteFile (in: hFile=0x55c, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0242.112] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0242.112] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0242.112] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0242.112] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c2f020 | out: hHeap=0x310000) returned 1 [0242.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0242.117] CloseHandle (hObject=0x55c) returned 1 [0242.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0242.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0242.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0242.117] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0242.117] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0242.117] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0242.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0242.118] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0242.118] GetLastError () returned 0x0 [0242.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0242.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x3caf5a0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0242.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0242.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0242.118] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0242.119] WriteFile (in: hFile=0x55c, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3caf6dc*=0xe54, lpOverlapped=0x0) returned 1 [0242.120] CloseHandle (hObject=0x55c) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0242.120] CryptDestroyKey (hKey=0x5261448) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x556ffb0 | out: hHeap=0x310000) returned 1 [0242.120] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53529c0 | out: hHeap=0x310000) returned 1 [0242.120] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0242.120] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0242.121] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.121] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0242.153] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.154] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0242.154] CloseHandle (hObject=0x55c) returned 1 [0242.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19df8 [0242.154] RmStartSession () returned 0x0 [0242.457] RmRegisterResources () returned 0x0 [0242.458] RmGetList () returned 0x0 [0242.618] RmShutdown () returned 0x0 [0243.706] RmEndSession () returned 0x0 [0243.707] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261488) returned 1 [0243.707] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0243.707] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar", dwFileAttributes=0x20) returned 1 [0243.707] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0243.707] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0243.707] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=44516) returned 1 [0243.707] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0243.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5738020 [0244.064] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0244.064] ReadFile (in: hFile=0x55c, lpBuffer=0x5738040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x5738040*, lpNumberOfBytesRead=0x3caf768*=0xade4, lpOverlapped=0x0) returned 1 [0244.066] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.066] CryptEncrypt (in: hKey=0x5261488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d7a0e0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0244.066] WriteFile (in: hFile=0x55c, lpBuffer=0x5d7a0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5d7a0e0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0244.067] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0244.067] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0244.067] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0244.067] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5738020 | out: hHeap=0x310000) returned 1 [0244.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d7a0c0 | out: hHeap=0x310000) returned 1 [0244.342] CloseHandle (hObject=0x55c) returned 1 [0244.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0244.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0244.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ba0 [0244.342] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0244.342] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0244.342] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0244.343] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19600 [0244.343] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0244.343] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0244.343] GetLastError () returned 0x0 [0244.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0244.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x3caf5a0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dbs6NV", lpUsedDefaultChar=0x0) returned 6 [0244.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0244.344] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0244.344] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0244.345] WriteFile (in: hFile=0x55c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe59, lpOverlapped=0x0) returned 1 [0244.346] CloseHandle (hObject=0x55c) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19600 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ba0 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0244.346] CryptDestroyKey (hKey=0x5261488) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19df8 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c396e8 | out: hHeap=0x310000) returned 1 [0244.346] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352790 | out: hHeap=0x310000) returned 1 [0244.346] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0244.347] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0244.347] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.347] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0244.349] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.349] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0244.349] CloseHandle (hObject=0x55c) returned 1 [0244.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0244.349] RmStartSession () returned 0x0 [0244.350] RmRegisterResources () returned 0x0 [0244.355] RmGetList () returned 0x0 [0244.745] RmShutdown () returned 0x0 [0245.369] RmEndSession () returned 0x0 [0245.370] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x52617c8) returned 1 [0245.370] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0245.370] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc", dwFileAttributes=0x20) returned 1 [0245.370] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0245.370] CryptEncrypt (in: hKey=0x52617c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0245.370] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=3770) returned 1 [0245.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0245.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x780d020 [0246.005] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0246.005] GetLastError () returned 0x0 [0246.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qL4KWuTlRzCIw", cchWideChar=13, lpMultiByteStr=0x3caf5a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qL4KWuTlRzCIw", lpUsedDefaultChar=0x0) returned 13 [0246.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0246.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0246.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0246.005] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0246.005] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0246.006] WriteFile (in: hFile=0x55c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe60, lpOverlapped=0x0) returned 1 [0246.007] CloseHandle (hObject=0x55c) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391cb0 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0246.007] CryptDestroyKey (hKey=0x52617c8) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39d78 | out: hHeap=0x310000) returned 1 [0246.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352420 | out: hHeap=0x310000) returned 1 [0246.007] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0246.008] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0246.008] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.008] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0246.009] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.009] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0246.009] CloseHandle (hObject=0x55c) returned 1 [0246.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0246.009] RmStartSession () returned 0x0 [0246.010] RmRegisterResources () returned 0x0 [0246.011] RmGetList () returned 0x0 [0246.035] RmShutdown () returned 0x0 [0247.629] RmEndSession () returned 0x0 [0247.629] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261ac8) returned 1 [0247.629] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0247.630] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf", dwFileAttributes=0x20) returned 1 [0247.630] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0247.630] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0247.630] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=234068) returned 1 [0247.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0247.630] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79ef020 [0251.796] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0251.796] GetLastError () returned 0x0 [0251.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0251.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x3caf5a0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y", lpUsedDefaultChar=0x0) returned 1 [0251.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0251.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0251.797] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0251.801] WriteFile (in: hFile=0x55c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3caf6dc*=0xe54, lpOverlapped=0x0) returned 1 [0251.802] CloseHandle (hObject=0x55c) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3918a0 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0251.802] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570af8 | out: hHeap=0x310000) returned 1 [0251.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352560 | out: hHeap=0x310000) returned 1 [0251.802] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0251.802] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0251.802] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.802] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0251.816] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.816] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0251.816] CloseHandle (hObject=0x55c) returned 1 [0251.816] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3918a0 [0251.816] RmStartSession () returned 0x0 [0251.817] RmRegisterResources () returned 0x0 [0251.818] RmGetList () returned 0x0 [0253.180] RmShutdown () returned 0x0 [0255.057] RmEndSession () returned 0x0 [0255.058] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261308) returned 1 [0255.058] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0255.058] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", dwFileAttributes=0x20) returned 1 [0255.058] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0255.058] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0255.058] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=54560347) returned 1 [0255.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0255.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x77c0020 [0255.076] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0255.076] ReadFile (in: hFile=0x55c, lpBuffer=0x77c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x77c0040*, lpNumberOfBytesRead=0x3caf768*=0x100000, lpOverlapped=0x0) returned 1 [0255.764] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0255.764] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.764] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.764] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.764] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.765] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.765] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.766] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.766] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.767] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.767] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.768] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.768] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.769] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.769] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.770] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.770] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.771] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.771] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.772] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.772] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.773] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.773] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.774] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.774] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.774] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.774] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.778] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.778] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.778] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.778] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.778] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.778] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.778] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.778] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.779] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.779] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.780] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.780] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.781] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.781] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.782] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.782] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.783] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.783] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.784] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.784] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.785] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.785] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.787] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.787] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.787] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.787] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.787] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.787] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.787] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0255.787] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0255.787] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0255.787] ReadFile (in: hFile=0x55c, lpBuffer=0x77c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x77c0040*, lpNumberOfBytesRead=0x3caf768*=0x100000, lpOverlapped=0x0) returned 1 [0256.430] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0256.430] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.430] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.430] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.430] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.431] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.431] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.432] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.432] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.433] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.433] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.434] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.434] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.435] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.435] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.436] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.436] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.437] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.437] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.438] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.438] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.439] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.439] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.440] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.440] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.441] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.441] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.442] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.442] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.443] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.443] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.444] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.444] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.445] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.445] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0256.446] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0256.446] WriteFile (in: hFile=0x55c, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0278.133] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0278.133] GetLastError () returned 0x0 [0278.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0278.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c480, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0278.133] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7a0 | out: hHeap=0x310000) returned 1 [0278.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0278.133] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0278.134] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0278.134] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0278.134] WriteFile (in: hFile=0x55c, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3caf6dc*=0xe68, lpOverlapped=0x0) returned 1 [0278.135] CloseHandle (hObject=0x55c) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0278.135] CryptDestroyKey (hKey=0x5261308) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3918a0 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a25e8 | out: hHeap=0x310000) returned 1 [0278.135] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353050 | out: hHeap=0x310000) returned 1 [0278.135] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0278.136] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0278.136] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.136] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0278.137] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0278.137] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0278.137] CloseHandle (hObject=0x55c) returned 1 [0278.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2d88 [0278.138] RmStartSession () returned 0x0 [0278.139] RmRegisterResources () returned 0x0 [0278.139] RmGetList () returned 0x0 [0279.287] RmShutdown () returned 0x0 [0279.931] RmEndSession () returned 0x0 [0279.931] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261a88) returned 1 [0279.931] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0279.931] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF", dwFileAttributes=0x220) returned 1 [0279.932] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0279.932] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0279.932] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=6060) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0279.932] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6219020 [0279.953] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0279.953] ReadFile (in: hFile=0x55c, lpBuffer=0x6219040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x6219040*, lpNumberOfBytesRead=0x3caf768*=0x17ac, lpOverlapped=0x0) returned 1 [0279.986] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0279.986] CryptEncrypt (in: hKey=0x5261a88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cdc040*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cdc040*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0279.986] WriteFile (in: hFile=0x55c, lpBuffer=0x5cdc040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5cdc040*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0279.991] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0279.991] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0279.991] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0279.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6219020 | out: hHeap=0x310000) returned 1 [0279.996] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cdc020 | out: hHeap=0x310000) returned 1 [0279.996] CloseHandle (hObject=0x55c) returned 1 [0279.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0279.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0279.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0279.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0279.997] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0279.997] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0279.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4120 [0279.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0279.997] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0279.998] GetLastError () returned 0x0 [0279.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0279.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0279.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c480, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0279.998] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e7da20 | out: hHeap=0x310000) returned 1 [0279.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0279.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0279.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0279.998] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0279.999] WriteFile (in: hFile=0x55c, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6f, lpOverlapped=0x0) returned 1 [0280.000] CloseHandle (hObject=0x55c) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4120 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0280.000] CryptDestroyKey (hKey=0x5261a88) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2d88 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6278 | out: hHeap=0x310000) returned 1 [0280.000] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2050 | out: hHeap=0x310000) returned 1 [0280.000] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0280.000] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0280.001] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.001] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0280.474] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.474] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0280.474] CloseHandle (hObject=0x55c) returned 1 [0280.474] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0280.474] RmStartSession () returned 0x0 [0280.579] RmRegisterResources () returned 0x0 [0280.579] RmGetList () returned 0x0 [0280.711] RmShutdown () returned 0x0 [0281.469] RmEndSession () returned 0x0 [0281.470] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x35d808) returned 1 [0281.470] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0281.470] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF", dwFileAttributes=0x220) returned 1 [0281.471] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0281.471] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0281.471] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=7804) returned 1 [0281.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47008 [0281.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7910020 [0282.202] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0282.202] ReadFile (in: hFile=0x55c, lpBuffer=0x7910040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x7910040*, lpNumberOfBytesRead=0x3caf768*=0x1e7c, lpOverlapped=0x0) returned 1 [0282.205] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0282.205] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0282.205] WriteFile (in: hFile=0x55c, lpBuffer=0x6b47020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x6b47020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0282.205] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0282.205] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0282.205] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0282.206] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7910020 | out: hHeap=0x310000) returned 1 [0282.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b47008 | out: hHeap=0x310000) returned 1 [0282.534] CloseHandle (hObject=0x55c) returned 1 [0282.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0282.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0282.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0282.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0282.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0282.535] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0282.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0282.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0282.535] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0282.536] GetLastError () returned 0x0 [0282.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0282.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fl", cchWideChar=2, lpMultiByteStr=0x3caf5a0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fl", lpUsedDefaultChar=0x0) returned 2 [0282.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0282.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0282.536] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0282.537] WriteFile (in: hFile=0x55c, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3caf6dc*=0xe55, lpOverlapped=0x0) returned 1 [0282.538] CloseHandle (hObject=0x55c) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0282.538] CryptDestroyKey (hKey=0x35d808) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94898 | out: hHeap=0x310000) returned 1 [0282.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1c40 | out: hHeap=0x310000) returned 1 [0282.538] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0282.538] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0282.539] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.539] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0282.550] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0282.550] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0282.550] CloseHandle (hObject=0x55c) returned 1 [0282.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0282.550] RmStartSession () returned 0x0 [0282.552] RmRegisterResources () returned 0x0 [0282.552] RmGetList () returned 0x0 [0282.597] RmShutdown () returned 0x0 [0284.550] RmEndSession () returned 0x0 [0284.551] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261088) returned 1 [0284.551] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0284.551] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF", dwFileAttributes=0x220) returned 1 [0284.551] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0284.551] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0284.551] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=11636) returned 1 [0284.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0284.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78e9020 [0284.580] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0284.580] ReadFile (in: hFile=0x55c, lpBuffer=0x78e9040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x78e9040*, lpNumberOfBytesRead=0x3caf768*=0x2d74, lpOverlapped=0x0) returned 1 [0285.080] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0285.080] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0285.080] WriteFile (in: hFile=0x55c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0285.081] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0285.081] WriteFile (in: hFile=0x55c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0285.081] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0285.081] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0285.081] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0285.082] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x78e9020 | out: hHeap=0x310000) returned 1 [0285.512] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0285.512] CloseHandle (hObject=0x55c) returned 1 [0285.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0285.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0285.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0285.512] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0285.512] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0285.512] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0285.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0285.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be280 [0285.513] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0285.513] GetLastError () returned 0x0 [0285.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x3caf5a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0285.514] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0285.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0285.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0285.514] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0285.514] WriteFile (in: hFile=0x55c, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe5f, lpOverlapped=0x0) returned 1 [0285.516] CloseHandle (hObject=0x55c) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0285.516] CryptDestroyKey (hKey=0x5261088) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94d58 | out: hHeap=0x310000) returned 1 [0285.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e26e0 | out: hHeap=0x310000) returned 1 [0285.516] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0285.516] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0285.517] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.517] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0286.056] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.056] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0286.056] CloseHandle (hObject=0x55c) returned 1 [0286.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0286.056] RmStartSession () returned 0x0 [0286.058] RmRegisterResources () returned 0x0 [0286.058] RmGetList () returned 0x0 [0286.252] RmShutdown () returned 0x0 [0289.411] RmEndSession () returned 0x0 [0289.996] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261ac8) returned 1 [0289.996] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0289.996] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF", dwFileAttributes=0x220) returned 1 [0289.997] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0289.997] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0289.997] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=14540) returned 1 [0289.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0289.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf4020 [0290.028] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0290.028] ReadFile (in: hFile=0x55c, lpBuffer=0x4cf4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x4cf4040*, lpNumberOfBytesRead=0x3caf768*=0x38cc, lpOverlapped=0x0) returned 1 [0290.055] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0290.055] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0290.055] WriteFile (in: hFile=0x55c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0290.056] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0290.056] WriteFile (in: hFile=0x55c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0290.056] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0290.056] WriteFile (in: hFile=0x55c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0290.056] WriteFile (in: hFile=0x55c, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0290.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf4020 | out: hHeap=0x310000) returned 1 [0290.061] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0290.061] CloseHandle (hObject=0x55c) returned 1 [0290.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0290.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4378 [0290.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5db8 [0290.061] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c44e8 [0290.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4378 | out: hHeap=0x310000) returned 1 [0290.062] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a57c8 [0290.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb820 [0290.063] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0290.063] GetLastError () returned 0x0 [0290.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0290.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0290.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c1b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0290.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e910 | out: hHeap=0x310000) returned 1 [0290.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0290.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0290.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.063] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0290.064] WriteFile (in: hFile=0x55c, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe6f, lpOverlapped=0x0) returned 1 [0290.065] CloseHandle (hObject=0x55c) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb820 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a57c8 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c44e8 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5db8 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0290.065] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95938 | out: hHeap=0x310000) returned 1 [0290.065] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2a00 | out: hHeap=0x310000) returned 1 [0290.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0290.066] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c [0290.066] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.066] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0290.580] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.580] ReadFile (in: hFile=0x55c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0290.580] CloseHandle (hObject=0x55c) returned 1 [0290.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a4be8 [0290.580] RmStartSession () returned 0x0 [0290.717] RmRegisterResources () returned 0x0 [0290.717] RmGetList () returned 0x0 [0291.066] RmShutdown () returned 0x0 [0292.404] RmEndSession () returned 0x0 [0292.617] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x35d808) returned 1 [0292.617] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0292.617] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF", dwFileAttributes=0x220) returned 1 [0292.617] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0292.617] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0292.617] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=1464) returned 1 [0292.617] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0292.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ee020 [0292.637] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0292.637] ReadFile (in: hFile=0x4d4, lpBuffer=0x49ee040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x49ee040*, lpNumberOfBytesRead=0x3caf768*=0x5b8, lpOverlapped=0x0) returned 1 [0292.637] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0292.637] CryptEncrypt (in: hKey=0x35d808, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0292.637] WriteFile (in: hFile=0x4d4, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0292.637] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0292.637] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0292.638] WriteFile (in: hFile=0x4d4, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0292.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ee020 | out: hHeap=0x310000) returned 1 [0292.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0292.643] CloseHandle (hObject=0x4d4) returned 1 [0292.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0292.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5400 [0292.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5568 [0292.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4d88 [0292.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5400 | out: hHeap=0x310000) returned 1 [0292.643] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0292.644] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb9b8 [0292.644] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0292.644] GetLastError () returned 0x0 [0292.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x3caf5a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0292.645] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.645] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0292.646] WriteFile (in: hFile=0x4d4, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3caf6dc*=0xe56, lpOverlapped=0x0) returned 1 [0292.647] CloseHandle (hObject=0x4d4) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb9b8 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4d88 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5568 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0292.647] CryptDestroyKey (hKey=0x35d808) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4be8 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95510 | out: hHeap=0x310000) returned 1 [0292.647] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609ef8 | out: hHeap=0x310000) returned 1 [0292.647] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0292.647] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0292.648] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.648] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0293.025] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.025] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0293.026] CloseHandle (hObject=0x4d4) returned 1 [0293.026] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0293.026] RmStartSession () returned 0x0 [0293.630] RmRegisterResources () returned 0x0 [0293.630] RmGetList () returned 0x0 [0294.018] RmShutdown () returned 0x0 [0296.406] RmEndSession () returned 0x0 [0296.407] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3caf868 | out: phKey=0x3caf868*=0x5261048) returned 1 [0296.407] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0296.407] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF", dwFileAttributes=0x220) returned 1 [0296.407] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0296.407] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3caf6c8*=0x2000) returned 1 [0296.407] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3caf760 | out: lpFileSize=0x3caf760*=3780) returned 1 [0296.407] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0296.408] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76ff020 [0296.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0296.641] ReadFile (in: hFile=0x4ac, lpBuffer=0x76ff040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3caf768, lpOverlapped=0x0 | out: lpBuffer=0x76ff040*, lpNumberOfBytesRead=0x3caf768*=0xec4, lpOverlapped=0x0) returned 1 [0296.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf750 | out: lpNewFilePointer=0x0) returned 1 [0296.641] CryptEncrypt (in: hKey=0x5261048, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x3caf6dc*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x3caf6dc*=0x2000) returned 1 [0296.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x3caf76c*=0x2000, lpOverlapped=0x0) returned 1 [0296.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caf758 | out: lpNewFilePointer=0x0) returned 1 [0296.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3caf76c*=0x200, lpOverlapped=0x0) returned 1 [0296.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x3caf708*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x3caf708*, lpNumberOfBytesWritten=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0296.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76ff020 | out: hHeap=0x310000) returned 1 [0296.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0296.659] CloseHandle (hObject=0x4ac) returned 1 [0296.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0296.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606c628 [0296.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c953e0 [0296.659] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606d318 [0296.659] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606c628 | out: hHeap=0x310000) returned 1 [0296.659] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0296.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95050 [0296.660] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0296.660] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3caf53c | out: lpSystemTimeAsFileTime=0x3caf53c) [0296.660] GetLastError () returned 0x0 [0296.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0296.661] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0296.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e0sG9NpfUiifqv54", cchWideChar=16, lpMultiByteStr=0x38c188, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e0sG9NpfUiifqv54", lpUsedDefaultChar=0x0) returned 16 [0296.661] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0296.661] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0296.661] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0296.661] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0296.661] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0296.662] WriteFile (in: hFile=0x4ac, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3caf6dc, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3caf6dc*=0xe63, lpOverlapped=0x0) returned 1 [0296.663] CloseHandle (hObject=0x4ac) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95050 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606d318 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c953e0 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0296.663] CryptDestroyKey (hKey=0x5261048) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306ca0 | out: hHeap=0x310000) returned 1 [0296.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x560a0d8 | out: hHeap=0x310000) returned 1 [0296.663] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3caf89c, lpCompletionKey=0x3caf8a0, lpOverlapped=0x3caf898) returned 1 [0296.663] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0296.664] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf770 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.664] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf76c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf76c*=0x18, lpOverlapped=0x0) returned 1 [0296.695] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3caf778 | out: lpNewFilePointer=0xffffffff) returned 1 [0296.695] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3caf760, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3caf760*=0x18, lpOverlapped=0x0) returned 1 [0296.695] CloseHandle (hObject=0x4ac) returned 1 [0296.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94470 [0296.696] RmStartSession () returned 0x0 [0297.053] RmRegisterResources () returned 0x0 [0297.058] RmGetList () returned 0x0 [0297.466] RmShutdown () returned 0x0 [0299.787] RmEndSession () Thread: id = 17 os_tid = 0x1110 [0068.627] GetLastError () returned 0x57 [0068.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x3570d0 [0068.627] SetLastError (dwErrCode=0x57) [0068.627] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0077.171] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0080.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0081.326] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0083.639] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0085.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0086.297] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0090.083] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0100.064] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0125.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0126.621] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0127.652] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0128.725] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0129.880] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0130.913] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0131.972] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0133.003] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 0 [0134.196] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0135.626] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0135.626] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.626] ReadFile (in: hFile=0x5c4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0135.651] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.651] ReadFile (in: hFile=0x5c4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0135.651] CloseHandle (hObject=0x5c4) returned 1 [0135.651] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0136.003] RmStartSession () returned 0x0 [0137.842] RmRegisterResources () returned 0x0 [0137.847] RmGetList () returned 0x0 [0140.169] RmShutdown () returned 0x0 [0144.167] RmEndSession () returned 0x0 [0144.168] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261848) returned 1 [0144.168] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0144.168] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0144.168] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0144.168] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0144.168] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=77748) returned 1 [0144.168] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3edeb8 [0144.169] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a74020 [0144.522] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0144.522] ReadFile (in: hFile=0x630, lpBuffer=0x6a74040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6a74040*, lpNumberOfBytesRead=0x3def7d0*=0x12fb4, lpOverlapped=0x0) returned 1 [0144.525] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0144.525] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.525] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.525] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.525] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.525] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.525] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.525] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.525] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.526] CryptEncrypt (in: hKey=0x5261848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x3edec0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0144.526] WriteFile (in: hFile=0x630, lpBuffer=0x3edec0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3edec0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0144.527] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0144.527] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0144.527] WriteFile (in: hFile=0x630, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0144.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a74020 | out: hHeap=0x310000) returned 1 [0144.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3edeb8 | out: hHeap=0x310000) returned 1 [0144.960] CloseHandle (hObject=0x630) returned 1 [0144.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0144.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0144.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0144.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaad8 [0144.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0144.962] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1030\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0144.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2310 [0144.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0144.963] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0144.963] GetLastError () returned 0x0 [0144.963] SetLastError (dwErrCode=0x0) [0144.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eac70 [0144.963] GetLastError () returned 0x0 [0144.963] SetLastError (dwErrCode=0x0) [0144.963] GetLastError () returned 0x0 [0144.963] SetLastError (dwErrCode=0x0) [0144.963] GetLastError () returned 0x0 [0144.964] SetLastError (dwErrCode=0x0) [0144.964] GetLastError () returned 0x0 [0144.964] SetLastError (dwErrCode=0x0) [0144.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eac70 | out: hHeap=0x310000) returned 1 [0144.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0144.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x3def600, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NQM", lpUsedDefaultChar=0x0) returned 3 [0144.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0144.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x53651a8 [0144.964] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1030\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0144.965] WriteFile (in: hFile=0x630, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x3def744*=0xe56, lpOverlapped=0x0) returned 1 [0144.966] CloseHandle (hObject=0x630) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53651a8 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2310 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0144.966] CryptDestroyKey (hKey=0x5261848) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0144.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365b88 | out: hHeap=0x310000) returned 1 [0144.966] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0144.966] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0144.966] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.967] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0144.981] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.981] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0144.981] CloseHandle (hObject=0x630) returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3993a8 [0144.981] RmStartSession () returned 0x0 [0144.985] RmRegisterResources () returned 0x0 [0144.990] RmGetList () returned 0x0 [0146.247] RmShutdown () returned 0x0 [0147.784] RmEndSession () returned 0x0 [0147.785] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261088) returned 1 [0147.785] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0147.786] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x80) returned 1 [0147.786] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0147.786] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0147.786] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=4040) returned 1 [0147.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0147.786] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6a2d020 [0147.928] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0147.928] ReadFile (in: hFile=0x630, lpBuffer=0x6a2d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6a2d040*, lpNumberOfBytesRead=0x3def7d0*=0xfc8, lpOverlapped=0x0) returned 1 [0147.930] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0147.930] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3def744*=0x2000) returned 1 [0147.930] WriteFile (in: hFile=0x630, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0147.930] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x630, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0147.930] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6a2d020 | out: hHeap=0x310000) returned 1 [0148.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0148.005] CloseHandle (hObject=0x630) returned 1 [0148.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0148.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0148.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3998d0 [0148.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1d60 [0148.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0148.008] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\\\588bce7c90097ed212\\1045\\eula.rtf.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.bdcddcbaad"), dwFlags=0x1) returned 1 [0148.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0148.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0148.013] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb8a8 [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.014] SetLastError (dwErrCode=0x0) [0148.014] GetLastError () returned 0x0 [0148.015] SetLastError (dwErrCode=0x0) [0148.015] GetLastError () returned 0x0 [0148.015] SetLastError (dwErrCode=0x0) [0148.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb8a8 | out: hHeap=0x310000) returned 1 [0148.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0148.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wmgdxOo64GZeM", cchWideChar=13, lpMultiByteStr=0x3def600, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmgdxOo64GZeM", lpUsedDefaultChar=0x0) returned 13 [0148.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0148.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0148.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0148.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c18 [0148.015] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1045\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0148.015] WriteFile (in: hFile=0x630, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x3def744*=0xe60, lpOverlapped=0x0) returned 1 [0148.016] CloseHandle (hObject=0x630) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c18 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1d60 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3998d0 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0148.018] CryptDestroyKey (hKey=0x5261088) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3993a8 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b38 | out: hHeap=0x310000) returned 1 [0148.018] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19330 | out: hHeap=0x310000) returned 1 [0148.018] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0148.018] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0148.018] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.018] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0148.044] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.045] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0148.045] CloseHandle (hObject=0x630) returned 1 [0148.045] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a24b0 [0148.045] RmStartSession () returned 0x0 [0148.050] RmRegisterResources () returned 0x0 [0148.054] RmGetList () returned 0x0 [0150.057] RmShutdown () returned 0x0 [0151.158] RmEndSession () returned 0x0 [0151.159] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260f48) returned 1 [0151.159] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0151.159] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0151.159] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0151.160] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0151.160] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=80254) returned 1 [0151.160] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12018 [0151.160] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6840020 [0151.273] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0151.273] ReadFile (in: hFile=0x630, lpBuffer=0x6840040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6840040*, lpNumberOfBytesRead=0x3def7d0*=0x1397e, lpOverlapped=0x0) returned 1 [0151.338] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0151.338] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.338] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.338] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.338] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.339] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.340] CryptEncrypt (in: hKey=0x5260f48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0151.340] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0151.340] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0151.340] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0151.340] WriteFile (in: hFile=0x630, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0151.340] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6840020 | out: hHeap=0x310000) returned 1 [0151.345] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12018 | out: hHeap=0x310000) returned 1 [0151.345] CloseHandle (hObject=0x630) returned 1 [0151.348] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0151.348] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a33c8 [0151.348] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2788 [0151.348] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2e78 [0151.348] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a33c8 | out: hHeap=0x310000) returned 1 [0151.348] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\2070\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0151.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1fd0 [0151.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0151.349] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3670 [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] GetLastError () returned 0x0 [0151.349] SetLastError (dwErrCode=0x0) [0151.349] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c2c8 [0151.350] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] GetLastError () returned 0x0 [0151.350] SetLastError (dwErrCode=0x0) [0151.350] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3670 | out: hHeap=0x310000) returned 1 [0151.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0151.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0151.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0151.351] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c2c8 | out: hHeap=0x310000) returned 1 [0151.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0151.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bb0b30 [0151.351] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c398c8 [0151.351] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\2070\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0151.352] WriteFile (in: hFile=0x630, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3def744*=0xe69, lpOverlapped=0x0) returned 1 [0151.352] CloseHandle (hObject=0x630) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c398c8 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1fd0 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2e78 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2788 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0151.353] CryptDestroyKey (hKey=0x5260f48) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a24b0 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060838 | out: hHeap=0x310000) returned 1 [0151.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19420 | out: hHeap=0x310000) returned 1 [0151.353] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0151.353] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0151.353] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.353] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0151.366] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.366] ReadFile (in: hFile=0x630, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0151.366] CloseHandle (hObject=0x630) returned 1 [0151.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f68 [0151.367] RmStartSession () returned 0x0 [0151.370] RmRegisterResources () returned 0x0 [0151.374] RmGetList () returned 0x0 [0154.583] RmShutdown () returned 0x0 [0155.547] RmEndSession () returned 0x0 [0156.094] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260f08) returned 1 [0156.094] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0156.095] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico", dwFileAttributes=0x80) returned 1 [0156.095] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0156.095] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0156.095] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=894) returned 1 [0156.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5c12008 [0156.096] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57fd020 [0156.116] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0156.116] ReadFile (in: hFile=0x630, lpBuffer=0x57fd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x57fd040*, lpNumberOfBytesRead=0x3def7d0*=0x37e, lpOverlapped=0x0) returned 1 [0156.143] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0156.143] CryptEncrypt (in: hKey=0x5260f08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5c12020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0156.143] WriteFile (in: hFile=0x630, lpBuffer=0x5c12020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5c12020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0156.144] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0156.144] WriteFile (in: hFile=0x630, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0156.144] WriteFile (in: hFile=0x630, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0156.145] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57fd020 | out: hHeap=0x310000) returned 1 [0156.151] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c12008 | out: hHeap=0x310000) returned 1 [0156.151] CloseHandle (hObject=0x630) returned 1 [0156.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0156.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0540 [0156.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0156.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0156.153] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0156.153] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0156.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0156.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0156.154] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.154] GetLastError () returned 0x0 [0156.154] SetLastError (dwErrCode=0x0) [0156.155] GetLastError () returned 0x0 [0156.155] SetLastError (dwErrCode=0x0) [0156.155] GetLastError () returned 0x0 [0156.155] SetLastError (dwErrCode=0x0) [0156.155] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0156.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HmW07Tc", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0156.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HmW07Tc", cchWideChar=7, lpMultiByteStr=0x3def600, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HmW07Tc", lpUsedDefaultChar=0x0) returned 7 [0156.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bab400 [0156.155] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f01f8 [0156.155] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0156.236] WriteFile (in: hFile=0x5b0, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x3def744*=0xe5a, lpOverlapped=0x0) returned 1 [0156.237] CloseHandle (hObject=0x5b0) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f01f8 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0156.239] CryptDestroyKey (hKey=0x5260f08) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f68 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060220 | out: hHeap=0x310000) returned 1 [0156.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19790 | out: hHeap=0x310000) returned 1 [0156.239] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0156.239] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0156.239] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.239] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0156.241] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.241] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0156.241] CloseHandle (hObject=0x5b0) returned 1 [0156.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1cf8 [0156.242] RmStartSession () returned 0x0 [0156.391] RmRegisterResources () returned 0x0 [0156.395] RmGetList () returned 0x0 [0157.186] RmShutdown () returned 0x0 [0158.376] RmEndSession () returned 0x0 [0158.377] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52619c8) returned 1 [0158.377] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0158.377] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi", dwFileAttributes=0x80) returned 1 [0158.378] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0158.378] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0158.378] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=495616) returned 1 [0158.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc2630 [0158.378] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2d020 [0158.711] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0158.711] ReadFile (in: hFile=0x674, lpBuffer=0x4c2d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x4c2d040*, lpNumberOfBytesRead=0x3def7d0*=0x79000, lpOverlapped=0x0) returned 1 [0158.717] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0158.717] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.717] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.718] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.718] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.736] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.736] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.737] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.737] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.738] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.738] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.739] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.739] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.740] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.740] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.740] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.740] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.740] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.740] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.740] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.740] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.741] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.741] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.742] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.743] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.743] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.744] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.744] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.745] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.745] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0158.745] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0158.745] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0158.745] WriteFile (in: hFile=0x674, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0158.745] WriteFile (in: hFile=0x674, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0158.746] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c2d020 | out: hHeap=0x310000) returned 1 [0159.609] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc2630 | out: hHeap=0x310000) returned 1 [0159.609] CloseHandle (hObject=0x674) returned 1 [0159.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0159.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0159.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0159.619] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0159.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0159.620] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0159.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2928 [0159.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0159.620] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0159.620] GetLastError () returned 0x0 [0159.620] SetLastError (dwErrCode=0x0) [0159.620] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.621] GetLastError () returned 0x0 [0159.621] SetLastError (dwErrCode=0x0) [0159.622] GetLastError () returned 0x0 [0159.622] SetLastError (dwErrCode=0x0) [0159.622] GetLastError () returned 0x0 [0159.622] SetLastError (dwErrCode=0x0) [0159.622] GetLastError () returned 0x0 [0159.622] SetLastError (dwErrCode=0x0) [0159.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0159.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0159.622] GetLastError () returned 0x0 [0159.622] SetLastError (dwErrCode=0x0) [0159.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0159.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0159.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0159.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r8qa7ZyzJ1OtQOBkD", cchWideChar=17, lpMultiByteStr=0x38c3b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r8qa7ZyzJ1OtQOBkD", lpUsedDefaultChar=0x0) returned 17 [0159.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0159.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0159.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bafca8 [0159.622] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0159.622] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0159.623] WriteFile (in: hFile=0x674, lpBuffer=0x4bafca8*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bafca8*, lpNumberOfBytesWritten=0x3def744*=0xe64, lpOverlapped=0x0) returned 1 [0159.624] CloseHandle (hObject=0x674) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bafca8 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2928 | out: hHeap=0x310000) returned 1 [0159.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0159.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0159.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0159.625] CryptDestroyKey (hKey=0x52619c8) returned 1 [0159.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1cf8 | out: hHeap=0x310000) returned 1 [0159.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1f00 | out: hHeap=0x310000) returned 1 [0159.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5f80 | out: hHeap=0x310000) returned 1 [0159.625] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0159.625] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0159.625] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.625] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0159.629] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.629] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0159.629] CloseHandle (hObject=0x674) returned 1 [0159.629] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399820 [0159.629] RmStartSession () returned 0x0 [0159.632] RmRegisterResources () returned 0x0 [0159.636] RmGetList () returned 0x0 [0160.166] RmShutdown () returned 0x0 [0160.743] RmEndSession () returned 0x0 [0160.744] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261908) returned 1 [0160.744] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0160.744] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x80) returned 1 [0160.744] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0160.745] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0160.745] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=104072) returned 1 [0160.745] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc2630 [0160.745] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6d09020 [0160.987] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0160.987] ReadFile (in: hFile=0x674, lpBuffer=0x6d09040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6d09040*, lpNumberOfBytesRead=0x3def7d0*=0x19688, lpOverlapped=0x0) returned 1 [0161.007] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0161.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.007] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.007] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.007] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.007] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.007] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.007] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.008] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.008] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.008] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.008] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.008] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.009] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.009] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.009] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3def744*=0x2000) returned 1 [0161.009] WriteFile (in: hFile=0x674, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0161.009] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0161.009] WriteFile (in: hFile=0x674, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0161.009] WriteFile (in: hFile=0x674, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0161.010] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6d09020 | out: hHeap=0x310000) returned 1 [0161.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc2630 | out: hHeap=0x310000) returned 1 [0161.015] CloseHandle (hObject=0x674) returned 1 [0161.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0161.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0161.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399b90 [0161.017] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2448 [0161.017] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0161.017] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\\\588bce7c90097ed212\\watermark.bmp.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.bdcddcbaad"), dwFlags=0x1) returned 1 [0161.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0161.018] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0161.018] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0161.018] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.019] SetLastError (dwErrCode=0x0) [0161.019] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b928 [0161.020] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.020] GetLastError () returned 0x0 [0161.020] SetLastError (dwErrCode=0x0) [0161.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0161.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0161.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0161.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="asZJGyY6zFo1elxK4hBU7cY", cchWideChar=23, lpMultiByteStr=0x38c3b8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="asZJGyY6zFo1elxK4hBU7cY", lpUsedDefaultChar=0x0) returned 23 [0161.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b928 | out: hHeap=0x310000) returned 1 [0161.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4badf98 [0161.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baee20 [0161.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1b58 [0161.021] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0161.022] WriteFile (in: hFile=0x674, lpBuffer=0x4baee20*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4baee20*, lpNumberOfBytesWritten=0x3def744*=0xe6a, lpOverlapped=0x0) returned 1 [0161.023] CloseHandle (hObject=0x674) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1b58 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2448 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399b90 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0161.024] CryptDestroyKey (hKey=0x5261908) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399820 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d78 | out: hHeap=0x310000) returned 1 [0161.024] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365688 | out: hHeap=0x310000) returned 1 [0161.024] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0161.024] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0161.024] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.024] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0161.301] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.301] ReadFile (in: hFile=0x674, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0161.301] CloseHandle (hObject=0x674) returned 1 [0161.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4a18 [0161.301] RmStartSession () returned 0x0 [0162.451] RmRegisterResources () returned 0x0 [0162.462] RmGetList () returned 0x0 [0163.221] RmShutdown () returned 0x0 [0163.770] RmEndSession () returned 0x0 [0164.671] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261908) returned 1 [0164.671] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0164.672] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0164.672] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0164.672] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0164.672] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=5091790) returned 1 [0164.672] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0164.673] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x57fd020 [0164.691] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0164.691] ReadFile (in: hFile=0x694, lpBuffer=0x57fd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x57fd040*, lpNumberOfBytesRead=0x3def7d0*=0x100000, lpOverlapped=0x0) returned 1 [0164.761] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0164.761] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.761] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.761] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.761] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.761] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.761] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.761] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.761] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.761] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.762] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.762] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.763] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.763] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.764] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.764] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.765] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.765] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.765] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.765] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0164.765] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0164.765] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.430] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.430] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.431] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.431] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.434] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.434] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.434] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.434] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.434] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.434] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.435] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.435] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.436] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.436] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.437] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.437] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.438] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.438] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.438] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.438] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.438] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.438] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.438] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.438] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.439] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.439] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.440] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.440] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.441] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.441] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.442] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.442] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.443] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.443] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.444] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.444] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.445] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.445] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.446] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.447] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.447] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.448] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.448] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.449] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.449] CryptEncrypt (in: hKey=0x5261908, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0165.449] WriteFile (in: hFile=0x694, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0165.449] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0165.449] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0165.450] WriteFile (in: hFile=0x694, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0165.451] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x57fd020 | out: hHeap=0x310000) returned 1 [0168.046] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0168.046] CloseHandle (hObject=0x694) returned 1 [0169.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0169.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53215c0 [0169.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3230 [0169.535] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5322070 [0169.535] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53215c0 | out: hHeap=0x310000) returned 1 [0169.535] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.bdcddcbaad"), dwFlags=0x1) returned 1 [0169.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a39a0 [0169.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0169.536] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0169.536] GetLastError () returned 0x0 [0169.536] SetLastError (dwErrCode=0x0) [0169.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.537] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0169.537] GetLastError () returned 0x0 [0169.537] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0169.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0169.538] GetLastError () returned 0x0 [0169.538] SetLastError (dwErrCode=0x0) [0169.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0169.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0169.538] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0169.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vsPfwZLZiAU4bA46v", cchWideChar=17, lpMultiByteStr=0x38c3b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vsPfwZLZiAU4bA46v", lpUsedDefaultChar=0x0) returned 17 [0169.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0169.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0169.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4badf98 [0169.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0169.539] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0169.540] WriteFile (in: hFile=0x694, lpBuffer=0x4badf98*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4badf98*, lpNumberOfBytesWritten=0x3def744*=0xe64, lpOverlapped=0x0) returned 1 [0169.542] CloseHandle (hObject=0x694) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4badf98 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a39a0 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5322070 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3230 | out: hHeap=0x310000) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0169.542] CryptDestroyKey (hKey=0x5261908) returned 1 [0169.542] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4a18 | out: hHeap=0x310000) returned 1 [0169.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0169.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19650 | out: hHeap=0x310000) returned 1 [0169.543] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0169.543] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0169.543] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.543] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0169.545] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.545] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0169.545] CloseHandle (hObject=0x694) returned 1 [0169.545] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0169.545] RmStartSession () returned 0x0 [0169.549] RmRegisterResources () returned 0x0 [0169.555] RmGetList () returned 0x0 [0172.432] RmShutdown () returned 0x0 [0173.748] RmEndSession () returned 0x0 [0173.749] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261388) returned 1 [0173.749] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0173.749] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0173.749] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0173.749] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0173.749] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0173.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x533d0a8 [0173.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6fae020 [0174.018] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0174.018] ReadFile (in: hFile=0x694, lpBuffer=0x6fae040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6fae040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0174.020] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0174.021] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.021] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.021] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.021] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.021] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.021] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.021] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.021] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.022] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.022] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.022] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.022] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.022] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.022] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.022] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.022] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.022] CryptEncrypt (in: hKey=0x5261388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x533d0c0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0174.022] WriteFile (in: hFile=0x694, lpBuffer=0x533d0c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x533d0c0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0174.023] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0174.023] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0174.023] WriteFile (in: hFile=0x694, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0174.023] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6fae020 | out: hHeap=0x310000) returned 1 [0174.465] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x533d0a8 | out: hHeap=0x310000) returned 1 [0174.465] CloseHandle (hObject=0x694) returned 1 [0174.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0174.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321360 [0174.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3de0 [0174.468] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321820 [0174.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321360 | out: hHeap=0x310000) returned 1 [0174.468] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0174.469] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4770 [0174.469] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0174.469] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0174.469] GetLastError () returned 0x0 [0174.469] SetLastError (dwErrCode=0x0) [0174.469] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4880 [0174.469] GetLastError () returned 0x0 [0174.469] SetLastError (dwErrCode=0x0) [0174.469] GetLastError () returned 0x0 [0174.469] SetLastError (dwErrCode=0x0) [0174.469] GetLastError () returned 0x0 [0174.469] SetLastError (dwErrCode=0x0) [0174.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4880 | out: hHeap=0x310000) returned 1 [0174.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0174.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dz", cchWideChar=2, lpMultiByteStr=0x3def600, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dz", lpUsedDefaultChar=0x0) returned 2 [0174.469] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0174.469] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0174.470] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0174.470] WriteFile (in: hFile=0x694, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe55, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3def744*=0xe55, lpOverlapped=0x0) returned 1 [0174.471] CloseHandle (hObject=0x694) returned 1 [0174.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0174.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0174.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4770 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321820 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3de0 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0174.472] CryptDestroyKey (hKey=0x5261388) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0174.472] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6740 | out: hHeap=0x310000) returned 1 [0174.472] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0174.472] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0174.472] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.472] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0174.501] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.501] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0174.501] CloseHandle (hObject=0x694) returned 1 [0174.501] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f06a8 [0174.501] RmStartSession () returned 0x0 [0174.504] RmRegisterResources () returned 0x0 [0174.505] RmGetList () returned 0x0 [0174.856] RmShutdown () returned 0x0 [0176.942] RmEndSession () returned 0x0 [0177.250] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52619c8) returned 1 [0177.250] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0177.250] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0177.250] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0177.251] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0177.251] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0177.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0177.251] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x666e020 [0177.269] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0177.269] ReadFile (in: hFile=0x694, lpBuffer=0x666e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x666e040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0177.356] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0177.356] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.356] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.356] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.356] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.356] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.356] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.356] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.356] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.356] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.356] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.357] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.357] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.357] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.357] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0177.357] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0177.357] WriteFile (in: hFile=0x694, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0177.358] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x666e020 | out: hHeap=0x310000) returned 1 [0177.363] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0177.363] CloseHandle (hObject=0x694) returned 1 [0177.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0177.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0177.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f03d8 [0177.364] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0177.364] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0177.364] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0177.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0177.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0177.365] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.365] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.365] GetLastError () returned 0x0 [0177.365] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] GetLastError () returned 0x0 [0177.366] SetLastError (dwErrCode=0x0) [0177.366] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0177.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0177.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mLGY6f92w4A", cchWideChar=11, lpMultiByteStr=0x3def600, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mLGY6f92w4A", lpUsedDefaultChar=0x0) returned 11 [0177.366] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0177.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0177.366] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0177.366] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0177.367] WriteFile (in: hFile=0x694, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe5e, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3def744*=0xe5e, lpOverlapped=0x0) returned 1 [0177.368] CloseHandle (hObject=0x694) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f03d8 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0177.528] CryptDestroyKey (hKey=0x52619c8) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f06a8 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac20 | out: hHeap=0x310000) returned 1 [0177.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e60b0 | out: hHeap=0x310000) returned 1 [0177.528] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0177.528] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0177.528] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.528] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0177.542] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.542] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0177.542] CloseHandle (hObject=0x694) returned 1 [0177.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0177.543] RmStartSession () returned 0x0 [0177.925] RmRegisterResources () returned 0x0 [0177.929] RmGetList () returned 0x0 [0178.278] RmShutdown () returned 0x0 [0178.825] RmEndSession () returned 0x0 [0178.890] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260fc8) returned 1 [0178.890] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0178.891] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0178.891] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0178.891] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0178.891] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0178.891] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5343028 [0178.892] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x677d020 [0178.951] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0178.952] ReadFile (in: hFile=0x694, lpBuffer=0x677d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x677d040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0178.983] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.984] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.984] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.985] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.985] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.985] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.985] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.985] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5343040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0178.985] WriteFile (in: hFile=0x694, lpBuffer=0x5343040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5343040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0178.985] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0178.985] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0178.985] WriteFile (in: hFile=0x694, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0178.986] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x677d020 | out: hHeap=0x310000) returned 1 [0178.991] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5343028 | out: hHeap=0x310000) returned 1 [0178.991] CloseHandle (hObject=0x694) returned 1 [0178.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0178.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5344408 [0178.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0178.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5344360 [0178.993] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5344408 | out: hHeap=0x310000) returned 1 [0178.993] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0178.995] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0178.995] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0178.995] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.995] GetLastError () returned 0x0 [0178.995] SetLastError (dwErrCode=0x0) [0178.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b570 [0178.996] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] GetLastError () returned 0x0 [0178.996] SetLastError (dwErrCode=0x0) [0178.996] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0178.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0178.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0178.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z6SlG4j98JbFmSQSeg", cchWideChar=18, lpMultiByteStr=0x38c160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z6SlG4j98JbFmSQSeg", lpUsedDefaultChar=0x0) returned 18 [0178.996] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b570 | out: hHeap=0x310000) returned 1 [0178.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0178.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bab400 [0178.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0178.997] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0178.997] WriteFile (in: hFile=0x694, lpBuffer=0x4bab400*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x4bab400*, lpNumberOfBytesWritten=0x3def744*=0xe65, lpOverlapped=0x0) returned 1 [0178.998] CloseHandle (hObject=0x694) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab400 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5344360 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0178.999] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea8b8 | out: hHeap=0x310000) returned 1 [0178.999] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e66f0 | out: hHeap=0x310000) returned 1 [0178.999] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0178.999] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0178.999] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.999] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0179.199] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.199] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0179.199] CloseHandle (hObject=0x694) returned 1 [0179.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0cc0 [0179.199] RmStartSession () returned 0x0 [0179.217] RmRegisterResources () returned 0x0 [0179.220] RmGetList () returned 0x0 [0179.578] RmShutdown () returned 0x0 [0181.293] RmEndSession () returned 0x0 [0181.804] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260fc8) returned 1 [0181.804] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0181.804] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0181.804] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0181.805] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0181.805] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0181.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd40c8 [0181.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x583a020 [0181.824] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0181.824] ReadFile (in: hFile=0x694, lpBuffer=0x583a040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x583a040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0181.871] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0181.871] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.871] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.872] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.872] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.873] CryptEncrypt (in: hKey=0x5260fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd40e0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0181.873] WriteFile (in: hFile=0x694, lpBuffer=0x5bd40e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x694, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x694, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0181.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x583a020 | out: hHeap=0x310000) returned 1 [0181.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd40c8 | out: hHeap=0x310000) returned 1 [0181.878] CloseHandle (hObject=0x694) returned 1 [0182.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0182.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0182.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0c48 [0182.460] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0182.460] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0182.460] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0182.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0db0 [0182.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0182.461] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.461] SetLastError (dwErrCode=0x0) [0182.461] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.462] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b730 [0182.462] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0182.462] GetLastError () returned 0x0 [0182.462] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bab1d8 [0182.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] GetLastError () returned 0x0 [0182.463] SetLastError (dwErrCode=0x0) [0182.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0182.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0182.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0182.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x38c548, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YymLG954e9jSNEr4fGTQUdOu0cPg", lpUsedDefaultChar=0x0) returned 28 [0182.463] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bab1d8 | out: hHeap=0x310000) returned 1 [0182.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0182.463] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540d6a0 [0182.464] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0182.464] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0db0 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0c48 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0182.464] CryptDestroyKey (hKey=0x5260fc8) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae78 | out: hHeap=0x310000) returned 1 [0182.464] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6010 | out: hHeap=0x310000) returned 1 [0182.464] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0182.464] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0182.464] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.465] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0182.467] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.467] ReadFile (in: hFile=0x694, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0182.467] CloseHandle (hObject=0x694) returned 1 [0182.467] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c96c8 [0182.467] RmStartSession () returned 0x0 [0183.057] RmRegisterResources () returned 0x0 [0183.061] RmGetList () returned 0x0 [0183.717] RmShutdown () returned 0x0 [0185.246] RmEndSession () returned 0x0 [0185.247] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261208) returned 1 [0185.247] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0185.247] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0185.247] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0185.247] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0185.247] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0185.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0185.248] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58cf020 [0185.794] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0185.794] ReadFile (in: hFile=0x5b0, lpBuffer=0x58cf040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x58cf040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0185.811] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0185.811] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.811] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.811] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.811] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.811] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.811] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.811] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.811] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.811] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.811] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.812] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.812] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.812] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.812] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.812] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.812] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.812] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0185.812] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0185.812] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0185.812] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0185.813] WriteFile (in: hFile=0x5b0, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0185.813] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58cf020 | out: hHeap=0x310000) returned 1 [0187.639] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0187.639] CloseHandle (hObject=0x5b0) returned 1 [0187.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0187.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136550 [0187.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51ca1f0 [0187.641] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61368e8 [0187.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136550 | out: hHeap=0x310000) returned 1 [0187.641] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0187.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51c9f50 [0187.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0187.642] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.642] GetLastError () returned 0x0 [0187.642] SetLastError (dwErrCode=0x0) [0187.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0187.643] GetLastError () returned 0x0 [0187.643] SetLastError (dwErrCode=0x0) [0187.643] GetLastError () returned 0x0 [0187.643] SetLastError (dwErrCode=0x0) [0187.643] GetLastError () returned 0x0 [0187.643] SetLastError (dwErrCode=0x0) [0187.643] GetLastError () returned 0x0 [0187.643] SetLastError (dwErrCode=0x0) [0187.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0187.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0187.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K5peP9WcLDHI", cchWideChar=12, lpMultiByteStr=0x3def600, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K5peP9WcLDHI", lpUsedDefaultChar=0x0) returned 12 [0187.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0187.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0187.643] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0187.643] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0187.644] WriteFile (in: hFile=0x5b0, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x3def744*=0xe5f, lpOverlapped=0x0) returned 1 [0187.645] CloseHandle (hObject=0x5b0) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c9f50 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61368e8 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ca1f0 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0187.645] CryptDestroyKey (hKey=0x5261208) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51c96c8 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c926d0 | out: hHeap=0x310000) returned 1 [0187.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6f60 | out: hHeap=0x310000) returned 1 [0187.645] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0187.645] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0187.645] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.646] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0187.664] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.664] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0187.664] CloseHandle (hObject=0x5b0) returned 1 [0187.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6136b10 [0187.664] RmStartSession () returned 0x0 [0187.667] RmRegisterResources () returned 0x0 [0187.671] RmGetList () returned 0x0 [0188.004] RmShutdown () returned 0x0 [0191.297] RmEndSession () returned 0x0 [0191.300] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x35da08) returned 1 [0191.300] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0191.300] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0191.300] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0191.300] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0191.301] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=69632) returned 1 [0191.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5291cd8 [0191.301] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c29020 [0191.460] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0191.460] ReadFile (in: hFile=0x5b0, lpBuffer=0x4c29040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x4c29040*, lpNumberOfBytesRead=0x3def7d0*=0x11000, lpOverlapped=0x0) returned 1 [0191.463] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.463] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.463] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.464] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.464] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.464] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.464] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.464] CryptEncrypt (in: hKey=0x35da08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5291ce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0191.464] WriteFile (in: hFile=0x5b0, lpBuffer=0x5291ce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5291ce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0191.464] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0191.464] WriteFile (in: hFile=0x5b0, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0191.464] WriteFile (in: hFile=0x5b0, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0191.465] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c29020 | out: hHeap=0x310000) returned 1 [0191.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5291cd8 | out: hHeap=0x310000) returned 1 [0191.565] CloseHandle (hObject=0x5b0) returned 1 [0191.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0191.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x60f7360 [0191.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x61373b0 [0191.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x60f6280 [0191.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60f7360 | out: hHeap=0x310000) returned 1 [0191.568] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0191.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6137690 [0191.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0191.569] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] GetLastError () returned 0x0 [0191.569] SetLastError (dwErrCode=0x0) [0191.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0191.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.570] SetLastError (dwErrCode=0x0) [0191.570] GetLastError () returned 0x0 [0191.571] SetLastError (dwErrCode=0x0) [0191.571] GetLastError () returned 0x0 [0191.571] SetLastError (dwErrCode=0x0) [0191.571] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4bad028 [0191.571] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0191.571] GetLastError () returned 0x0 [0191.571] SetLastError (dwErrCode=0x0) [0191.571] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0191.571] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0191.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gak4kRfqDg73C45si1Fxf9cdl", cchWideChar=25, lpMultiByteStr=0x38c390, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gak4kRfqDg73C45si1Fxf9cdl", lpUsedDefaultChar=0x0) returned 25 [0191.571] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad028 | out: hHeap=0x310000) returned 1 [0191.571] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540f3b0 [0191.571] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540d6a0 [0191.571] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0191.571] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0191.572] WriteFile (in: hFile=0x5b0, lpBuffer=0x540d6a0*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x540d6a0*, lpNumberOfBytesWritten=0x3def744*=0xe6c, lpOverlapped=0x0) returned 1 [0191.573] CloseHandle (hObject=0x5b0) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540d6a0 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6137690 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x60f6280 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61373b0 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0191.573] CryptDestroyKey (hKey=0x35da08) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6136b10 | out: hHeap=0x310000) returned 1 [0191.573] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390550 | out: hHeap=0x310000) returned 1 [0191.574] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18b60 | out: hHeap=0x310000) returned 1 [0191.574] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0191.574] CreateFileW (lpFileName="C:\\\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0191.574] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.574] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0191.589] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.589] ReadFile (in: hFile=0x5b0, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0191.589] CloseHandle (hObject=0x5b0) returned 1 [0191.589] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb20 [0191.589] RmStartSession () returned 0x0 [0192.033] RmRegisterResources () returned 0x0 [0192.037] RmGetList () returned 0x0 [0194.398] RmShutdown () returned 0x0 [0197.947] RmEndSession () returned 0x0 [0197.948] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261a08) returned 1 [0197.948] GetFileAttributesW (lpFileName="C:\\\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0197.949] SetFileAttributesW (lpFileName="C:\\\\Logs\\System.evtx", dwFileAttributes=0x20) returned 1 [0197.949] CreateFileW (lpFileName="C:\\\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0197.949] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0197.949] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=1118208) returned 1 [0197.949] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x61fa008 [0197.949] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6213020 [0198.426] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0198.426] ReadFile (in: hFile=0x634, lpBuffer=0x6213040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x6213040*, lpNumberOfBytesRead=0x3def7d0*=0x100000, lpOverlapped=0x0) returned 1 [0198.438] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0198.438] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.438] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.438] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.438] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.438] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.438] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.438] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.438] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.438] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.438] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.439] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.439] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.439] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.439] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.439] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.440] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.441] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.441] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.442] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.442] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.442] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.442] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.442] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.443] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.443] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.443] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.443] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.443] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.443] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.444] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.444] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.444] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.444] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.444] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.444] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.445] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.446] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.447] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.447] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.447] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.447] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.447] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.448] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.449] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.450] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.450] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.450] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.450] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.450] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.451] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.452] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.453] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.453] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.453] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.453] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.453] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.454] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.454] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0198.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0198.454] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.209] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.210] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.210] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.211] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.211] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.225] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.225] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.225] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.225] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.225] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.225] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.226] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.226] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.227] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.227] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.227] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.227] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.227] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.227] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.228] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.228] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.228] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.228] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.228] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x61fa020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0199.228] WriteFile (in: hFile=0x634, lpBuffer=0x61fa020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x61fa020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0199.228] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0199.228] WriteFile (in: hFile=0x634, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0199.229] WriteFile (in: hFile=0x634, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0199.229] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6213020 | out: hHeap=0x310000) returned 1 [0200.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61fa008 | out: hHeap=0x310000) returned 1 [0200.398] CloseHandle (hObject=0x634) returned 1 [0200.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0200.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0200.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0200.398] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0200.398] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0200.398] MoveFileExW (lpExistingFileName="C:\\\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="C:\\\\Logs\\System.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\system.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0200.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b650 [0200.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0200.399] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0200.399] GetLastError () returned 0x0 [0200.399] SetLastError (dwErrCode=0x0) [0200.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51cc560 [0200.399] GetLastError () returned 0x0 [0200.399] SetLastError (dwErrCode=0x0) [0200.399] GetLastError () returned 0x0 [0200.399] SetLastError (dwErrCode=0x0) [0200.399] GetLastError () returned 0x0 [0200.399] SetLastError (dwErrCode=0x0) [0200.399] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] GetLastError () returned 0x0 [0200.400] SetLastError (dwErrCode=0x0) [0200.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0200.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0200.400] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] GetLastError () returned 0x0 [0200.401] SetLastError (dwErrCode=0x0) [0200.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51cc560 | out: hHeap=0x310000) returned 1 [0200.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xBCJFFG6GDWfVPKClFVzpe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0200.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xBCJFFG6GDWfVPKClFVzpe", cchWideChar=22, lpMultiByteStr=0x38c098, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xBCJFFG6GDWfVPKClFVzpe", lpUsedDefaultChar=0x0) returned 22 [0200.401] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0200.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0200.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0200.401] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0200.401] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0200.402] WriteFile (in: hFile=0x634, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3def744*=0xe69, lpOverlapped=0x0) returned 1 [0200.403] CloseHandle (hObject=0x634) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0200.403] CryptDestroyKey (hKey=0x5261a08) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b688 | out: hHeap=0x310000) returned 1 [0200.403] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44858 | out: hHeap=0x310000) returned 1 [0200.403] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0200.403] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0200.404] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.404] ReadFile (in: hFile=0x634, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0200.409] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.409] ReadFile (in: hFile=0x634, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0200.409] CloseHandle (hObject=0x634) returned 1 [0200.409] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ec008 [0200.410] RmStartSession () returned 0x0 [0200.414] RmRegisterResources () returned 0x0 [0200.418] RmGetList () returned 0x0 [0203.303] RmShutdown () returned 0x0 [0205.282] RmEndSession () returned 0x0 [0205.283] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261a08) returned 1 [0205.283] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0205.283] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui", dwFileAttributes=0x20) returned 0 [0205.284] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.284] CryptDestroyKey (hKey=0x5261a08) returned 1 [0205.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ec008 | out: hHeap=0x310000) returned 1 [0205.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390c80 | out: hHeap=0x310000) returned 1 [0205.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08140 | out: hHeap=0x310000) returned 1 [0205.284] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0205.284] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0205.318] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.318] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0205.319] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.319] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0205.320] CloseHandle (hObject=0x610) returned 1 [0205.320] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c928c8 [0205.320] RmStartSession () returned 0x0 [0205.325] RmRegisterResources () returned 0x0 [0205.671] RmGetList () returned 0x0 [0207.010] RmShutdown () returned 0x0 [0209.877] RmEndSession () returned 0x0 [0210.237] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261008) returned 1 [0210.237] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0210.237] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", dwFileAttributes=0x20) returned 0 [0210.237] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0210.237] CryptDestroyKey (hKey=0x5261008) returned 1 [0210.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c928c8 | out: hHeap=0x310000) returned 1 [0210.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93a80 | out: hHeap=0x310000) returned 1 [0210.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c085a0 | out: hHeap=0x310000) returned 1 [0210.237] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0210.237] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0210.237] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.237] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0210.241] SetFilePointerEx (in: hFile=0x610, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.241] ReadFile (in: hFile=0x610, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0210.241] CloseHandle (hObject=0x610) returned 1 [0210.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3913b0 [0210.241] RmStartSession () returned 0x0 [0210.320] RmRegisterResources () returned 0x0 [0210.321] RmGetList () returned 0x0 [0210.648] RmShutdown () returned 0x0 [0212.998] RmEndSession () returned 0x0 [0213.538] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260c88) returned 1 [0213.538] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0213.538] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", dwFileAttributes=0x20) returned 0 [0213.538] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.538] CryptDestroyKey (hKey=0x5260c88) returned 1 [0213.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3913b0 | out: hHeap=0x310000) returned 1 [0213.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc9f8 | out: hHeap=0x310000) returned 1 [0213.538] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5740 | out: hHeap=0x310000) returned 1 [0213.538] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0213.538] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0213.753] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.753] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0213.811] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.811] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0213.811] CloseHandle (hObject=0x54c) returned 1 [0213.812] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bccb8 [0213.812] RmStartSession () returned 0x0 [0213.813] RmRegisterResources () returned 0x0 [0213.814] RmGetList () returned 0x0 [0213.977] RmShutdown () returned 0x0 [0217.780] RmEndSession () returned 0x0 [0217.781] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261248) returned 1 [0217.781] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0217.781] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml", dwFileAttributes=0x20) returned 0 [0217.782] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.782] CryptDestroyKey (hKey=0x5261248) returned 1 [0217.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bccb8 | out: hHeap=0x310000) returned 1 [0217.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0217.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5b00 | out: hHeap=0x310000) returned 1 [0217.782] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0217.782] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0217.782] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.782] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0217.785] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.785] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0217.785] CloseHandle (hObject=0x54c) returned 1 [0217.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd318 [0217.785] RmStartSession () returned 0x0 [0217.788] RmRegisterResources () returned 0x0 [0217.789] RmGetList () returned 0x0 [0220.793] RmShutdown () returned 0x0 [0223.872] RmEndSession () returned 0x0 [0223.872] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260cc8) returned 1 [0223.872] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0223.873] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml", dwFileAttributes=0x20) returned 0 [0223.873] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.873] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0223.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd318 | out: hHeap=0x310000) returned 1 [0223.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb138 | out: hHeap=0x310000) returned 1 [0223.873] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5e20 | out: hHeap=0x310000) returned 1 [0223.873] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0223.873] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0223.873] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.873] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0223.876] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.876] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0223.876] CloseHandle (hObject=0x54c) returned 1 [0223.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3ee9d8 [0223.876] RmStartSession () returned 0x0 [0223.879] RmRegisterResources () returned 0x0 [0223.883] RmGetList () returned 0x0 [0225.322] RmShutdown () returned 0x0 [0226.341] RmEndSession () returned 0x0 [0226.342] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261048) returned 1 [0226.342] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0226.342] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0226.343] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.343] CryptDestroyKey (hKey=0x5261048) returned 1 [0226.343] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee9d8 | out: hHeap=0x310000) returned 1 [0226.343] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef260 | out: hHeap=0x310000) returned 1 [0226.343] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14470 | out: hHeap=0x310000) returned 1 [0226.343] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0226.343] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0226.346] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.346] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0226.353] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.353] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0226.353] CloseHandle (hObject=0x54c) returned 1 [0226.353] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0226.354] RmStartSession () returned 0x0 [0226.357] RmRegisterResources () returned 0x0 [0226.362] RmGetList () returned 0x0 [0228.314] RmShutdown () returned 0x0 [0230.419] RmEndSession () returned 0x0 [0230.419] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261248) returned 1 [0230.419] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0230.420] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x20) returned 0 [0230.420] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.420] CryptDestroyKey (hKey=0x5261248) returned 1 [0230.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0230.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef068 | out: hHeap=0x310000) returned 1 [0230.420] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c15050 | out: hHeap=0x310000) returned 1 [0230.420] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0230.420] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0230.420] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.420] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0230.453] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.453] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0230.453] CloseHandle (hObject=0x54c) returned 1 [0230.453] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0b58 [0230.453] RmStartSession () returned 0x0 [0230.455] RmRegisterResources () returned 0x0 [0230.455] RmGetList () returned 0x0 [0231.106] RmShutdown () returned 0x0 [0231.435] RmEndSession () returned 0x0 [0231.836] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260cc8) returned 1 [0231.836] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0231.836] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado27.tlb", dwFileAttributes=0x20) returned 0 [0231.836] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.836] CryptDestroyKey (hKey=0x5260cc8) returned 1 [0231.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0b58 | out: hHeap=0x310000) returned 1 [0231.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c90 | out: hHeap=0x310000) returned 1 [0231.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c191a0 | out: hHeap=0x310000) returned 1 [0231.836] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0231.836] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0231.837] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.837] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0231.861] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.861] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0231.861] CloseHandle (hObject=0x54c) returned 1 [0231.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19c90 [0231.861] RmStartSession () returned 0x0 [0231.863] RmRegisterResources () returned 0x0 [0231.863] RmGetList () returned 0x0 [0234.370] RmShutdown () returned 0x0 [0235.014] RmEndSession () returned 0x0 [0235.014] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260bc8) returned 1 [0235.015] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0235.015] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", dwFileAttributes=0x20) returned 0 [0235.015] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.015] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0235.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19c90 | out: hHeap=0x310000) returned 1 [0235.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19600 | out: hHeap=0x310000) returned 1 [0235.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19880 | out: hHeap=0x310000) returned 1 [0235.015] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0235.015] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0235.015] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.015] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0235.032] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.032] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0235.032] CloseHandle (hObject=0x54c) returned 1 [0235.032] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0235.032] RmStartSession () returned 0x0 [0235.034] RmRegisterResources () returned 0x0 [0235.034] RmGetList () returned 0x0 [0235.362] RmShutdown () returned 0x0 [0236.852] RmEndSession () returned 0x0 [0236.853] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261308) returned 1 [0236.853] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0236.853] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt", dwFileAttributes=0x20) returned 1 [0236.853] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0236.853] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0236.853] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=1423) returned 1 [0236.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54a2e50 [0236.853] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58a4020 [0237.049] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0237.049] ReadFile (in: hFile=0x54c, lpBuffer=0x58a4040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x58a4040*, lpNumberOfBytesRead=0x3def7d0*=0x58f, lpOverlapped=0x0) returned 1 [0237.050] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0237.050] CryptEncrypt (in: hKey=0x5261308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54a2e60*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x54a2e60*, pdwDataLen=0x3def744*=0x2000) returned 1 [0237.050] WriteFile (in: hFile=0x54c, lpBuffer=0x54a2e60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x54a2e60*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0237.050] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0237.050] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0237.051] WriteFile (in: hFile=0x54c, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0237.051] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58a4020 | out: hHeap=0x310000) returned 1 [0237.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54a2e50 | out: hHeap=0x310000) returned 1 [0237.277] CloseHandle (hObject=0x54c) returned 1 [0237.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0237.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0237.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0237.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0237.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0237.277] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.bdcddcbaad"), dwFlags=0x1) returned 1 [0237.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0237.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3918a0 [0237.278] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0237.278] GetLastError () returned 0x0 [0237.278] SetLastError (dwErrCode=0x0) [0237.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0237.278] GetLastError () returned 0x0 [0237.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0237.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8kda2ctzsSng7DS", cchWideChar=15, lpMultiByteStr=0x3def600, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8kda2ctzsSng7DS", lpUsedDefaultChar=0x0) returned 15 [0237.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0237.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0237.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0237.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b34a8 [0237.279] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0237.279] WriteFile (in: hFile=0x54c, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe62, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3def744*=0xe62, lpOverlapped=0x0) returned 1 [0237.280] CloseHandle (hObject=0x54c) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3918a0 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0237.280] CryptDestroyKey (hKey=0x5261308) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2b48 | out: hHeap=0x310000) returned 1 [0237.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571fc8 | out: hHeap=0x310000) returned 1 [0237.280] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0237.281] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0237.281] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.281] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0237.292] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.292] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0237.292] CloseHandle (hObject=0x54c) returned 1 [0237.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0237.292] RmStartSession () returned 0x0 [0237.295] RmRegisterResources () returned 0x0 [0237.295] RmGetList () returned 0x0 [0237.823] RmShutdown () returned 0x0 [0239.008] RmEndSession () returned 0x0 [0239.302] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261188) returned 1 [0239.302] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0239.302] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf", dwFileAttributes=0x20) returned 1 [0239.302] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0239.302] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0239.302] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=1044) returned 1 [0239.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0239.302] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c2020 [0239.330] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0239.333] ReadFile (in: hFile=0x54c, lpBuffer=0x65c2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x65c2040*, lpNumberOfBytesRead=0x3def7d0*=0x414, lpOverlapped=0x0) returned 1 [0239.380] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0239.380] CryptEncrypt (in: hKey=0x5261188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3def744*=0x2000) returned 1 [0239.380] WriteFile (in: hFile=0x54c, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0239.380] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0239.380] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0239.380] WriteFile (in: hFile=0x54c, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0239.380] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c2020 | out: hHeap=0x310000) returned 1 [0239.385] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0239.385] CloseHandle (hObject=0x54c) returned 1 [0239.385] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0239.385] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0239.385] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0239.386] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3080 [0239.386] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0239.386] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.bdcddcbaad"), dwFlags=0x1) returned 1 [0239.386] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0239.386] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0239.386] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0239.386] GetLastError () returned 0x0 [0239.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0239.387] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0239.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LUpoh1S64gDKMZE4Tnpz2A", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LUpoh1S64gDKMZE4Tnpz2A", lpUsedDefaultChar=0x0) returned 22 [0239.387] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6f8 | out: hHeap=0x310000) returned 1 [0239.387] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0239.387] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0239.387] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2960 [0239.387] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0239.388] WriteFile (in: hFile=0x54c, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3def744*=0xe69, lpOverlapped=0x0) returned 1 [0239.388] CloseHandle (hObject=0x54c) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2960 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3080 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0239.389] CryptDestroyKey (hKey=0x5261188) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2ce0 | out: hHeap=0x310000) returned 1 [0239.389] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55726f8 | out: hHeap=0x310000) returned 1 [0239.389] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0239.389] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0239.389] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.389] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0240.047] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.047] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0240.047] CloseHandle (hObject=0x54c) returned 1 [0240.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0240.047] RmStartSession () returned 0x0 [0240.290] RmRegisterResources () returned 0x0 [0240.290] RmGetList () returned 0x0 [0240.384] RmShutdown () returned 0x0 [0241.369] RmEndSession () returned 0x0 [0241.370] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261888) returned 1 [0241.370] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0241.370] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties", dwFileAttributes=0x20) returned 1 [0241.370] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0241.370] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0241.370] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=4072) returned 1 [0241.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b65070 [0241.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x65c2020 [0241.701] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0241.701] ReadFile (in: hFile=0x54c, lpBuffer=0x65c2040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x65c2040*, lpNumberOfBytesRead=0x3def7d0*=0xfe8, lpOverlapped=0x0) returned 1 [0241.702] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0241.702] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b65080*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b65080*, pdwDataLen=0x3def744*=0x2000) returned 1 [0241.702] WriteFile (in: hFile=0x54c, lpBuffer=0x4b65080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b65080*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0241.703] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0241.703] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0241.703] WriteFile (in: hFile=0x54c, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0241.703] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x65c2020 | out: hHeap=0x310000) returned 1 [0241.908] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b65070 | out: hHeap=0x310000) returned 1 [0241.909] CloseHandle (hObject=0x54c) returned 1 [0241.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0241.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dcf00 [0241.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0241.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc380 [0241.909] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0241.909] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0241.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93930 [0241.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3915c8 [0241.910] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0241.910] GetLastError () returned 0x0 [0241.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0241.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x3def600, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0241.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0241.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0241.910] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0241.911] WriteFile (in: hFile=0x54c, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3def744*=0xe54, lpOverlapped=0x0) returned 1 [0241.912] CloseHandle (hObject=0x54c) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3915c8 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc380 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0241.912] CryptDestroyKey (hKey=0x5261888) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee498 | out: hHeap=0x310000) returned 1 [0241.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572748 | out: hHeap=0x310000) returned 1 [0241.912] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0241.912] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0241.913] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.913] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0241.914] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.914] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0241.914] CloseHandle (hObject=0x54c) returned 1 [0241.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19858 [0241.914] RmStartSession () returned 0x0 [0242.427] RmRegisterResources () returned 0x0 [0242.427] RmGetList () returned 0x0 [0242.592] RmShutdown () returned 0x0 [0242.874] RmEndSession () returned 0x0 [0242.875] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261688) returned 1 [0242.875] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0242.875] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar", dwFileAttributes=0x20) returned 1 [0242.875] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0242.875] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0242.876] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=8286) returned 1 [0242.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b63030 [0242.876] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x589e020 [0243.795] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0243.795] ReadFile (in: hFile=0x558, lpBuffer=0x589e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x589e040*, lpNumberOfBytesRead=0x3def7d0*=0x205e, lpOverlapped=0x0) returned 1 [0243.796] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0243.796] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b63040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b63040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0243.797] WriteFile (in: hFile=0x558, lpBuffer=0x4b63040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b63040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0243.797] CryptEncrypt (in: hKey=0x5261688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b63040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b63040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0243.797] WriteFile (in: hFile=0x558, lpBuffer=0x4b63040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b63040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0243.797] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0243.797] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0243.797] WriteFile (in: hFile=0x558, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0243.797] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x589e020 | out: hHeap=0x310000) returned 1 [0243.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b63030 | out: hHeap=0x310000) returned 1 [0243.802] CloseHandle (hObject=0x558) returned 1 [0243.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0243.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0243.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ab0 [0243.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3b30 [0243.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0243.803] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0243.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19f60 [0243.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0243.804] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0243.804] GetLastError () returned 0x0 [0243.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0243.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dbs6NV", cchWideChar=6, lpMultiByteStr=0x3def600, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dbs6NV", lpUsedDefaultChar=0x0) returned 6 [0243.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0243.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0243.804] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0243.804] WriteFile (in: hFile=0x558, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3def744*=0xe59, lpOverlapped=0x0) returned 1 [0243.805] CloseHandle (hObject=0x558) returned 1 [0243.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0243.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0243.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19f60 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ab0 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0243.806] CryptDestroyKey (hKey=0x5261688) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19858 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c398c8 | out: hHeap=0x310000) returned 1 [0243.806] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352b00 | out: hHeap=0x310000) returned 1 [0243.806] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0243.806] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0243.806] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.806] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0243.808] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.808] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0243.808] CloseHandle (hObject=0x558) returned 1 [0243.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0243.808] RmStartSession () returned 0x0 [0243.810] RmRegisterResources () returned 0x0 [0243.810] RmGetList () returned 0x0 [0243.832] RmShutdown () returned 0x0 [0244.963] RmEndSession () returned 0x0 [0244.964] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261ac8) returned 1 [0244.964] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0244.964] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties", dwFileAttributes=0x20) returned 1 [0244.965] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0244.965] CryptEncrypt (in: hKey=0x5261ac8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0244.965] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=3928) returned 1 [0244.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7c100 [0244.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c2b020 [0245.278] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0245.278] GetLastError () returned 0x0 [0245.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0245.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UDTxCihSb", cchWideChar=9, lpMultiByteStr=0x3def600, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UDTxCihSb", lpUsedDefaultChar=0x0) returned 9 [0245.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0245.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0245.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0245.278] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0245.279] WriteFile (in: hFile=0x558, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3def744*=0xe5c, lpOverlapped=0x0) returned 1 [0245.279] CloseHandle (hObject=0x558) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be280 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0245.280] CryptDestroyKey (hKey=0x5261ac8) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2df0 | out: hHeap=0x310000) returned 1 [0245.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352380 | out: hHeap=0x310000) returned 1 [0245.280] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0245.280] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0245.280] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.280] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0245.282] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.283] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0245.283] CloseHandle (hObject=0x558) returned 1 [0245.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0245.283] RmStartSession () returned 0x0 [0245.285] RmRegisterResources () returned 0x0 [0245.289] RmGetList () returned 0x0 [0245.963] RmShutdown () returned 0x0 [0247.544] RmEndSession () returned 0x0 [0247.545] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52618c8) returned 1 [0247.545] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0247.545] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf", dwFileAttributes=0x20) returned 1 [0247.545] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0247.546] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0247.546] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=75124) returned 1 [0247.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d7a0c0 [0247.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f4020 [0251.159] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0251.159] GetLastError () returned 0x0 [0251.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0251.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0251.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c520, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0251.159] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50f29c0 | out: hHeap=0x310000) returned 1 [0251.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0251.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e8d38 [0251.159] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2c58 [0251.160] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0251.160] WriteFile (in: hFile=0x558, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3def744*=0xe70, lpOverlapped=0x0) returned 1 [0251.161] CloseHandle (hObject=0x558) returned 1 [0251.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2c58 | out: hHeap=0x310000) returned 1 [0251.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcf00 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93930 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0251.162] CryptDestroyKey (hKey=0x52618c8) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef998 | out: hHeap=0x310000) returned 1 [0251.162] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53521f0 | out: hHeap=0x310000) returned 1 [0251.162] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0251.162] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0251.162] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.162] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0251.163] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.163] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0251.163] CloseHandle (hObject=0x558) returned 1 [0251.164] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0251.164] RmStartSession () returned 0x0 [0251.165] RmRegisterResources () returned 0x0 [0251.166] RmGetList () returned 0x0 [0253.297] RmShutdown () returned 0x0 [0254.329] RmEndSession () returned 0x0 [0254.330] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261a08) returned 1 [0254.330] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0254.330] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", dwFileAttributes=0x20) returned 1 [0254.330] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0254.330] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0254.330] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=381) returned 1 [0254.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5485030 [0254.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x79bd020 [0254.556] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0254.556] ReadFile (in: hFile=0x558, lpBuffer=0x79bd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x79bd040*, lpNumberOfBytesRead=0x3def7d0*=0x17d, lpOverlapped=0x0) returned 1 [0254.557] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0254.557] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5485040*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5485040*, pdwDataLen=0x3def744*=0x2000) returned 1 [0254.557] WriteFile (in: hFile=0x558, lpBuffer=0x5485040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5485040*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0254.558] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0254.558] WriteFile (in: hFile=0x558, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0254.559] WriteFile (in: hFile=0x558, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0254.559] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x79bd020 | out: hHeap=0x310000) returned 1 [0254.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5485030 | out: hHeap=0x310000) returned 1 [0254.626] CloseHandle (hObject=0x558) returned 1 [0254.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0254.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b37a0 [0254.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda88 [0254.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3a00 [0254.626] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0254.626] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0254.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdb10 [0254.627] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0254.627] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0254.627] GetLastError () returned 0x0 [0254.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BovCg0H", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0254.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BovCg0H", cchWideChar=7, lpMultiByteStr=0x3def600, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BovCg0H", lpUsedDefaultChar=0x0) returned 7 [0254.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0254.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bc7f0 [0254.628] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0254.629] WriteFile (in: hFile=0x558, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3def744*=0xe5a, lpOverlapped=0x0) returned 1 [0254.630] CloseHandle (hObject=0x558) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bc7f0 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdb10 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda88 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0254.630] CryptDestroyKey (hKey=0x5261a08) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2f00 | out: hHeap=0x310000) returned 1 [0254.630] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353320 | out: hHeap=0x310000) returned 1 [0254.630] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0254.630] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0254.630] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.630] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0254.664] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.664] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0254.664] CloseHandle (hObject=0x558) returned 1 [0254.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0254.664] RmStartSession () returned 0x0 [0254.665] RmRegisterResources () returned 0x0 [0254.666] RmGetList () returned 0x0 [0254.813] RmShutdown () returned 0x0 [0257.673] RmEndSession () returned 0x0 [0257.674] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261548) returned 1 [0257.674] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0257.674] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties", dwFileAttributes=0x20) returned 1 [0257.674] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0257.674] CryptEncrypt (in: hKey=0x5261548, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0257.674] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=1210) returned 1 [0257.674] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0257.675] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ee020 [0258.434] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0258.434] GetLastError () returned 0x0 [0258.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0258.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0258.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7Jqd1nQTWMi6MgqEEJIg", cchWideChar=20, lpMultiByteStr=0x38c1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Jqd1nQTWMi6MgqEEJIg", lpUsedDefaultChar=0x0) returned 20 [0258.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0258.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0258.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0258.434] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0258.434] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0258.435] WriteFile (in: hFile=0x558, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3def744*=0xe67, lpOverlapped=0x0) returned 1 [0258.436] CloseHandle (hObject=0x558) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0258.436] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0258.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0258.437] CryptDestroyKey (hKey=0x5261548) returned 1 [0258.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0258.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3918 | out: hHeap=0x310000) returned 1 [0258.437] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5353640 | out: hHeap=0x310000) returned 1 [0258.437] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0258.437] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0258.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.437] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0258.439] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.439] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0258.439] CloseHandle (hObject=0x558) returned 1 [0258.439] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0b0b0 [0258.439] RmStartSession () returned 0x0 [0258.440] RmRegisterResources () returned 0x0 [0258.444] RmGetList () returned 0x0 [0259.383] RmShutdown () returned 0x0 [0260.765] RmEndSession () returned 0x0 [0260.952] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261348) returned 1 [0260.952] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0260.952] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0260.952] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0260.952] CryptEncrypt (in: hKey=0x5261348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0260.952] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=253712) returned 1 [0260.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0260.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c26020 [0261.553] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0261.553] GetLastError () returned 0x0 [0261.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0261.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0261.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", cchWideChar=30, lpMultiByteStr=0x38c390, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gCACVPmNYCqJxTGqkt2X7qZL50yGyj", lpUsedDefaultChar=0x0) returned 30 [0261.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x61073e0 | out: hHeap=0x310000) returned 1 [0261.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0261.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54eaa48 [0261.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93e70 [0261.553] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0261.554] WriteFile (in: hFile=0x558, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3def744*=0xe71, lpOverlapped=0x0) returned 1 [0261.555] CloseHandle (hObject=0x558) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93e70 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ee8 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f050a0 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539ed78 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f04960 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0261.555] CryptDestroyKey (hKey=0x5261348) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0b0b0 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa2e0 | out: hHeap=0x310000) returned 1 [0261.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351e80 | out: hHeap=0x310000) returned 1 [0261.555] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0261.556] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0261.556] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.556] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0261.557] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.557] ReadFile (in: hFile=0x558, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0261.558] CloseHandle (hObject=0x558) returned 1 [0261.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f0adf8 [0261.558] RmStartSession () returned 0x0 [0261.804] RmRegisterResources () returned 0x0 [0261.808] RmGetList () returned 0x0 [0263.112] RmShutdown () returned 0x0 [0264.075] RmEndSession () returned 0x0 [0264.076] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52611c8) returned 1 [0264.076] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0264.076] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0264.076] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0264.076] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0264.076] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=357349) returned 1 [0264.076] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0264.077] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d4020 [0266.594] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0266.595] GetLastError () returned 0x0 [0266.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0266.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SIDVBtEvGHPdJc", cchWideChar=14, lpMultiByteStr=0x3def600, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SIDVBtEvGHPdJc", lpUsedDefaultChar=0x0) returned 14 [0266.595] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0266.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0266.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0266.595] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0266.595] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.596] WriteFile (in: hFile=0x680, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3def744*=0xe61, lpOverlapped=0x0) returned 1 [0266.597] CloseHandle (hObject=0x680) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0540 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5678 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x539c1e0 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba4d68 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0266.597] CryptDestroyKey (hKey=0x52611c8) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f0adf8 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5348a90 | out: hHeap=0x310000) returned 1 [0266.597] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19470 | out: hHeap=0x310000) returned 1 [0266.597] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0266.597] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0266.598] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.598] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0266.598] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0266.599] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0266.599] CloseHandle (hObject=0x680) returned 1 [0266.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0266.599] RmStartSession () returned 0x0 [0266.786] RmRegisterResources () returned 0x0 [0266.786] RmGetList () returned 0x0 [0266.880] RmShutdown () returned 0x0 [0269.027] RmEndSession () returned 0x0 [0269.028] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261088) returned 1 [0269.028] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0269.028] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml", dwFileAttributes=0x220) returned 1 [0269.028] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0269.028] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0269.028] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=373) returned 1 [0269.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cdc020 [0269.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78d7020 [0270.513] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0270.513] GetLastError () returned 0x0 [0270.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0270.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0270.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", cchWideChar=27, lpMultiByteStr=0x38c3b8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="On8R0hNA8jFvmoVAn8o4Hqn4q5Y", lpUsedDefaultChar=0x0) returned 27 [0270.513] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e89eb0 | out: hHeap=0x310000) returned 1 [0270.513] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0270.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e7eb0 [0270.514] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93bd0 [0270.514] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0270.515] WriteFile (in: hFile=0x554, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3def744*=0xe6e, lpOverlapped=0x0) returned 1 [0270.515] CloseHandle (hObject=0x554) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93bd0 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0798 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93738 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbf30 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0270.516] CryptDestroyKey (hKey=0x5261088) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efd88 | out: hHeap=0x310000) returned 1 [0270.516] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18fc0 | out: hHeap=0x310000) returned 1 [0270.516] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0270.516] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0270.516] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.516] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0270.546] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0270.546] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0270.546] CloseHandle (hObject=0x554) returned 1 [0270.546] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0270.546] RmStartSession () returned 0x0 [0270.549] RmRegisterResources () returned 0x0 [0270.549] RmGetList () returned 0x0 [0272.462] RmShutdown () returned 0x0 [0272.918] RmEndSession () returned 0x0 [0272.988] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52611c8) returned 1 [0272.988] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0272.988] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF", dwFileAttributes=0x220) returned 1 [0272.988] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0272.988] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0272.989] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=13254) returned 1 [0272.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0272.989] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6214020 [0273.030] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0273.030] GetLastError () returned 0x0 [0273.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0273.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x3def600, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xAw10", lpUsedDefaultChar=0x0) returned 5 [0273.030] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0273.031] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0273.031] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0273.031] WriteFile (in: hFile=0x554, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3def744*=0xe58, lpOverlapped=0x0) returned 1 [0273.032] CloseHandle (hObject=0x554) returned 1 [0273.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0273.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0273.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0273.032] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53c9800 | out: hHeap=0x310000) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2e20 | out: hHeap=0x310000) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0273.033] CryptDestroyKey (hKey=0x52611c8) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5990 | out: hHeap=0x310000) returned 1 [0273.033] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3270 | out: hHeap=0x310000) returned 1 [0273.033] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0273.033] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0273.033] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.033] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0273.065] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.065] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0273.065] CloseHandle (hObject=0x554) returned 1 [0273.065] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0273.065] RmStartSession () returned 0x0 [0273.067] RmRegisterResources () returned 0x0 [0273.068] RmGetList () returned 0x0 [0273.852] RmShutdown () returned 0x0 [0276.018] RmEndSession () returned 0x0 [0276.020] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260bc8) returned 1 [0276.020] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0276.020] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF", dwFileAttributes=0x220) returned 1 [0276.020] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0276.020] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0276.020] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=3026) returned 1 [0276.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0276.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6580020 [0277.214] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0277.214] GetLastError () returned 0x0 [0277.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0277.214] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0277.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="terRLaOJV2Dtqoxu0p", cchWideChar=18, lpMultiByteStr=0x38c3b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="terRLaOJV2Dtqoxu0p", lpUsedDefaultChar=0x0) returned 18 [0277.215] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b8b8 | out: hHeap=0x310000) returned 1 [0277.215] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0277.215] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0277.215] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.215] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0277.216] WriteFile (in: hFile=0x554, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3def744*=0xe65, lpOverlapped=0x0) returned 1 [0277.217] CloseHandle (hObject=0x554) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b37a0 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0277.217] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a51d8 | out: hHeap=0x310000) returned 1 [0277.217] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e30e0 | out: hHeap=0x310000) returned 1 [0277.217] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0277.217] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0277.217] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.217] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0277.219] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.219] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0277.219] CloseHandle (hObject=0x554) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0277.219] RmStartSession () returned 0x0 [0277.223] RmRegisterResources () returned 0x0 [0277.226] RmGetList () returned 0x0 [0278.535] RmShutdown () returned 0x0 [0279.896] RmEndSession () returned 0x0 [0279.897] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261508) returned 1 [0279.897] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0279.897] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF", dwFileAttributes=0x220) returned 1 [0279.897] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0279.897] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0279.897] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=7372) returned 1 [0279.897] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0279.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56ff020 [0280.472] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0280.472] ReadFile (in: hFile=0x554, lpBuffer=0x56ff040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x56ff040*, lpNumberOfBytesRead=0x3def7d0*=0x1ccc, lpOverlapped=0x0) returned 1 [0280.479] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0280.479] CryptEncrypt (in: hKey=0x5261508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0280.479] WriteFile (in: hFile=0x554, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0280.479] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0280.479] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0280.480] WriteFile (in: hFile=0x554, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0280.480] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56ff020 | out: hHeap=0x310000) returned 1 [0280.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0280.569] CloseHandle (hObject=0x554) returned 1 [0280.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0280.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0280.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2eb8 [0280.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1ca8 [0280.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0280.569] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0280.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b4088 [0280.573] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be308 [0280.573] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0280.573] GetLastError () returned 0x0 [0280.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0280.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0280.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", cchWideChar=28, lpMultiByteStr=0x38c160, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S1B1pBkkXsL5xaO01PUjcW9KyqK2", lpUsedDefaultChar=0x0) returned 28 [0280.574] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e804a0 | out: hHeap=0x310000) returned 1 [0280.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0280.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ee468 [0280.574] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0280.574] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0280.575] WriteFile (in: hFile=0x554, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3def744*=0xe6f, lpOverlapped=0x0) returned 1 [0280.576] CloseHandle (hObject=0x554) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be308 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b4088 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2eb8 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0280.576] CryptDestroyKey (hKey=0x5261508) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6868 | out: hHeap=0x310000) returned 1 [0280.576] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e19c0 | out: hHeap=0x310000) returned 1 [0280.576] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0280.576] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0280.576] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.576] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0280.601] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0280.601] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0280.601] CloseHandle (hObject=0x554) returned 1 [0280.601] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0280.601] RmStartSession () returned 0x0 [0280.633] RmRegisterResources () returned 0x0 [0280.634] RmGetList () returned 0x0 [0280.738] RmShutdown () returned 0x0 [0282.521] RmEndSession () returned 0x0 [0282.522] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260e08) returned 1 [0282.522] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0282.522] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF", dwFileAttributes=0x220) returned 1 [0282.522] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0282.522] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0282.523] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=3228) returned 1 [0282.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c0fcd0 [0282.523] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7b38020 [0283.160] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0283.160] ReadFile (in: hFile=0x554, lpBuffer=0x7b38040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x7b38040*, lpNumberOfBytesRead=0x3def7d0*=0xc9c, lpOverlapped=0x0) returned 1 [0283.161] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0283.161] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c0fce0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c0fce0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0283.161] WriteFile (in: hFile=0x554, lpBuffer=0x6c0fce0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x6c0fce0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0283.161] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0283.161] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0283.161] WriteFile (in: hFile=0x554, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0283.161] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7b38020 | out: hHeap=0x310000) returned 1 [0284.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c0fcd0 | out: hHeap=0x310000) returned 1 [0284.469] CloseHandle (hObject=0x554) returned 1 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0ab0 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1bf0 [0284.470] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0ab0 | out: hHeap=0x310000) returned 1 [0284.470] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3e28 [0284.470] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0284.471] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0284.471] GetLastError () returned 0x0 [0284.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0284.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sW6xAztyt", cchWideChar=9, lpMultiByteStr=0x3def600, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sW6xAztyt", lpUsedDefaultChar=0x0) returned 9 [0284.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0284.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0284.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0284.471] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0284.472] WriteFile (in: hFile=0x554, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe5c, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3def744*=0xe5c, lpOverlapped=0x0) returned 1 [0284.473] CloseHandle (hObject=0x554) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3e28 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1bf0 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0284.473] CryptDestroyKey (hKey=0x5260e08) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c945a0 | out: hHeap=0x310000) returned 1 [0284.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1920 | out: hHeap=0x310000) returned 1 [0284.473] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0284.473] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0284.473] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.474] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0284.475] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0284.475] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0284.475] CloseHandle (hObject=0x554) returned 1 [0284.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b31b0 [0284.475] RmStartSession () returned 0x0 [0284.477] RmRegisterResources () returned 0x0 [0284.478] RmGetList () returned 0x0 [0284.506] RmShutdown () returned 0x0 [0285.894] RmEndSession () returned 0x0 [0285.895] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261888) returned 1 [0285.895] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0285.895] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x220) returned 1 [0285.895] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0285.895] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0285.895] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=4066) returned 1 [0285.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4ba7380 [0285.895] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7914020 [0286.958] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0286.958] ReadFile (in: hFile=0x554, lpBuffer=0x7914040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x7914040*, lpNumberOfBytesRead=0x3def7d0*=0xfe2, lpOverlapped=0x0) returned 1 [0286.958] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0286.958] CryptEncrypt (in: hKey=0x5261888, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4ba73a0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4ba73a0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0286.958] WriteFile (in: hFile=0x554, lpBuffer=0x4ba73a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4ba73a0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0286.958] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0286.958] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0286.958] WriteFile (in: hFile=0x554, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0286.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x7914020 | out: hHeap=0x310000) returned 1 [0287.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba7380 | out: hHeap=0x310000) returned 1 [0287.058] CloseHandle (hObject=0x554) returned 1 [0287.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0287.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c35d0 [0287.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5270 [0287.058] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c2548 [0287.058] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c35d0 | out: hHeap=0x310000) returned 1 [0287.059] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0287.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a54d0 [0287.059] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0287.059] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0287.060] GetLastError () returned 0x0 [0287.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0287.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0287.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROQXe5ltuBK41ZqGEav", cchWideChar=19, lpMultiByteStr=0x38c4d0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ROQXe5ltuBK41ZqGEav", lpUsedDefaultChar=0x0) returned 19 [0287.060] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0287.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0287.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0287.060] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0287.060] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0287.061] WriteFile (in: hFile=0x554, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3def744*=0xe66, lpOverlapped=0x0) returned 1 [0287.062] CloseHandle (hObject=0x554) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a54d0 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c2548 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5270 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0287.062] CryptDestroyKey (hKey=0x5261888) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b31b0 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94cc0 | out: hHeap=0x310000) returned 1 [0287.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2c80 | out: hHeap=0x310000) returned 1 [0287.062] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0287.063] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0287.063] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.063] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0287.066] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0287.066] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0287.066] CloseHandle (hObject=0x554) returned 1 [0287.066] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2cf0 [0287.066] RmStartSession () returned 0x0 [0287.068] RmRegisterResources () returned 0x0 [0287.068] RmGetList () returned 0x0 [0288.488] RmShutdown () returned 0x0 [0289.952] RmEndSession () returned 0x0 [0290.143] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x52618c8) returned 1 [0290.143] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0290.143] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF", dwFileAttributes=0x220) returned 1 [0290.143] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0290.143] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0290.143] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=15733) returned 1 [0290.143] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b62f88 [0290.144] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5734020 [0290.164] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0290.164] ReadFile (in: hFile=0x554, lpBuffer=0x5734040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x5734040*, lpNumberOfBytesRead=0x3def7d0*=0x3d75, lpOverlapped=0x0) returned 1 [0290.239] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0290.239] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0290.239] WriteFile (in: hFile=0x554, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0290.239] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b62fa0*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b62fa0*, pdwDataLen=0x3def744*=0x2000) returned 1 [0290.239] WriteFile (in: hFile=0x554, lpBuffer=0x4b62fa0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x4b62fa0*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0290.239] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0290.240] WriteFile (in: hFile=0x554, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0290.240] WriteFile (in: hFile=0x554, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0290.240] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5734020 | out: hHeap=0x310000) returned 1 [0290.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b62f88 | out: hHeap=0x310000) returned 1 [0290.245] CloseHandle (hObject=0x554) returned 1 [0290.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0290.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0290.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a51d8 [0290.245] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0290.245] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0290.245] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5ac0 [0290.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0290.246] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0290.246] GetLastError () returned 0x0 [0290.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0290.246] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0290.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", cchWideChar=28, lpMultiByteStr=0x38c3e0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wlk7fg7JQ1SG8MGMkABsygV3a67k", lpUsedDefaultChar=0x0) returned 28 [0290.246] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x603e870 | out: hHeap=0x310000) returned 1 [0290.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0290.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0290.247] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.247] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0290.247] WriteFile (in: hFile=0x554, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3def744*=0xe6f, lpOverlapped=0x0) returned 1 [0290.248] CloseHandle (hObject=0x554) returned 1 [0290.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0290.248] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5ac0 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a51d8 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0290.249] CryptDestroyKey (hKey=0x52618c8) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2cf0 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95478 | out: hHeap=0x310000) returned 1 [0290.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2af0 | out: hHeap=0x310000) returned 1 [0290.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0290.249] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0290.249] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.249] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0290.590] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.590] ReadFile (in: hFile=0x554, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0290.590] CloseHandle (hObject=0x554) returned 1 [0290.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5600 [0290.590] RmStartSession () returned 0x0 [0290.975] RmRegisterResources () returned 0x0 [0290.975] RmGetList () returned 0x0 [0291.095] RmShutdown () returned 0x0 [0292.002] RmEndSession () returned 0x0 [0292.003] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x35dc08) returned 1 [0292.003] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0292.003] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF", dwFileAttributes=0x220) returned 1 [0292.003] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0292.003] CryptEncrypt (in: hKey=0x35dc08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0292.003] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=3986) returned 1 [0292.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0292.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76fb020 [0292.366] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0292.366] ReadFile (in: hFile=0x56c, lpBuffer=0x76fb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x76fb040*, lpNumberOfBytesRead=0x3def7d0*=0xf92, lpOverlapped=0x0) returned 1 [0292.366] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0292.366] CryptEncrypt (in: hKey=0x35dc08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5281b60*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x5281b60*, pdwDataLen=0x3def744*=0x2000) returned 1 [0292.366] WriteFile (in: hFile=0x56c, lpBuffer=0x5281b60*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x5281b60*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0292.367] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0292.367] WriteFile (in: hFile=0x56c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0292.367] WriteFile (in: hFile=0x56c, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0292.367] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76fb020 | out: hHeap=0x310000) returned 1 [0292.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5281b40 | out: hHeap=0x310000) returned 1 [0292.410] CloseHandle (hObject=0x56c) returned 1 [0292.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0292.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0292.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5b58 [0292.410] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0292.410] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0292.410] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0292.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5bf0 [0292.411] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0292.411] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0292.411] GetLastError () returned 0x0 [0292.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0292.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jVx", cchWideChar=3, lpMultiByteStr=0x3def600, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jVx", lpUsedDefaultChar=0x0) returned 3 [0292.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ed5e0 [0292.412] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0292.412] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0292.413] WriteFile (in: hFile=0x56c, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3def744*=0xe56, lpOverlapped=0x0) returned 1 [0292.414] CloseHandle (hObject=0x56c) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5bf0 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5b58 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0292.414] CryptDestroyKey (hKey=0x35dc08) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5600 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306748 | out: hHeap=0x310000) returned 1 [0292.414] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609b38 | out: hHeap=0x310000) returned 1 [0292.414] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0292.414] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x56c [0292.415] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.415] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0292.426] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0292.427] ReadFile (in: hFile=0x56c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0292.427] CloseHandle (hObject=0x56c) returned 1 [0292.427] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5600 [0292.427] RmStartSession () returned 0x0 [0293.584] RmRegisterResources () returned 0x0 [0293.585] RmGetList () returned 0x0 [0293.924] RmShutdown () returned 0x0 [0294.709] RmEndSession () returned 0x0 [0294.710] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5260d88) returned 1 [0294.710] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0294.711] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF", dwFileAttributes=0x220) returned 1 [0294.711] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0294.711] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0294.711] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=1736) returned 1 [0294.711] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0294.712] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x56fe020 [0294.806] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0294.806] ReadFile (in: hFile=0x640, lpBuffer=0x56fe040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x56fe040*, lpNumberOfBytesRead=0x3def7d0*=0x6c8, lpOverlapped=0x0) returned 1 [0294.806] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0294.806] CryptEncrypt (in: hKey=0x5260d88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0294.806] WriteFile (in: hFile=0x640, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0294.807] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0294.807] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0294.807] WriteFile (in: hFile=0x640, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0294.807] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x56fe020 | out: hHeap=0x310000) returned 1 [0295.125] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0295.291] CloseHandle (hObject=0x640) returned 1 [0295.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0295.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3bf8b8 [0295.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95b98 [0295.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c00a0 [0295.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3bf8b8 | out: hHeap=0x310000) returned 1 [0295.292] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0295.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c959d0 [0295.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0295.292] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0295.292] GetLastError () returned 0x0 [0295.293] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0295.293] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrHQog3L8507y", cchWideChar=13, lpMultiByteStr=0x3def600, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrHQog3L8507y", lpUsedDefaultChar=0x0) returned 13 [0295.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0295.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0295.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ed5e0 [0295.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0295.293] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0295.294] WriteFile (in: hFile=0x640, lpBuffer=0x54ed5e0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54ed5e0*, lpNumberOfBytesWritten=0x3def744*=0xe60, lpOverlapped=0x0) returned 1 [0295.295] CloseHandle (hObject=0x640) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ed5e0 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c00a0 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95b98 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0295.295] CryptDestroyKey (hKey=0x5260d88) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5600 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5306b70 | out: hHeap=0x310000) returned 1 [0295.295] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609e58 | out: hHeap=0x310000) returned 1 [0295.295] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0295.295] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0295.295] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.296] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0295.312] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.312] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0295.312] CloseHandle (hObject=0x640) returned 1 [0295.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c95640 [0295.312] RmStartSession () returned 0x0 [0295.314] RmRegisterResources () returned 0x0 [0295.318] RmGetList () returned 0x0 [0296.224] RmShutdown () returned 0x0 [0298.202] RmEndSession () returned 0x0 [0298.203] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3def8d0 | out: phKey=0x3def8d0*=0x5261448) returned 1 [0298.203] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0298.203] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF", dwFileAttributes=0x220) returned 1 [0298.203] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0298.204] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3def730*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3def730*=0x2000) returned 1 [0298.204] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x3def7c8 | out: lpFileSize=0x3def7c8*=6256) returned 1 [0298.204] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0298.204] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x76f5020 [0298.528] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0298.528] ReadFile (in: hFile=0x640, lpBuffer=0x76f5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3def7d0, lpOverlapped=0x0 | out: lpBuffer=0x76f5040*, lpNumberOfBytesRead=0x3def7d0*=0x1870, lpOverlapped=0x0) returned 1 [0298.529] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7b8 | out: lpNewFilePointer=0x0) returned 1 [0298.529] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3def744*=0x2000) returned 1 [0298.529] WriteFile (in: hFile=0x640, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3def7d4*=0x2000, lpOverlapped=0x0) returned 1 [0298.529] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3def7c0 | out: lpNewFilePointer=0x0) returned 1 [0298.529] WriteFile (in: hFile=0x640, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3def7d4*=0x200, lpOverlapped=0x0) returned 1 [0298.529] WriteFile (in: hFile=0x640, lpBuffer=0x3def770*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x3def770*, lpNumberOfBytesWritten=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0298.530] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x76f5020 | out: hHeap=0x310000) returned 1 [0298.860] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0298.861] CloseHandle (hObject=0x640) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0298.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606dc70 [0298.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c959d0 [0298.861] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x606ec40 [0298.861] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606dc70 | out: hHeap=0x310000) returned 1 [0298.861] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94c28 [0298.862] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0298.862] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3def5a4 | out: lpSystemTimeAsFileTime=0x3def5a4) [0298.862] GetLastError () returned 0x0 [0298.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EMCq9yia0YqsRhVfnvRQ8CimLg", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0298.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0298.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EMCq9yia0YqsRhVfnvRQ8CimLg", cchWideChar=26, lpMultiByteStr=0x38c1b0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EMCq9yia0YqsRhVfnvRQ8CimLg", lpUsedDefaultChar=0x0) returned 26 [0298.863] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5dcd050 | out: hHeap=0x310000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0298.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0298.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0298.863] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0298.864] WriteFile (in: hFile=0x640, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6d, lpNumberOfBytesWritten=0x3def744, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3def744*=0xe6d, lpOverlapped=0x0) returned 1 [0298.865] CloseHandle (hObject=0x640) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94c28 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x606ec40 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c959d0 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0298.865] CryptDestroyKey (hKey=0x5261448) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c95640 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53053b0 | out: hHeap=0x310000) returned 1 [0298.865] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609c28 | out: hHeap=0x310000) returned 1 [0298.865] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3def904, lpCompletionKey=0x3def908, lpOverlapped=0x3def900) returned 1 [0298.865] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0298.866] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7d8 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.866] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7d4, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7d4*=0x18, lpOverlapped=0x0) returned 1 [0298.879] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3def7e0 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.879] ReadFile (in: hFile=0x640, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3def7c8, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3def7c8*=0x18, lpOverlapped=0x0) returned 1 [0298.879] CloseHandle (hObject=0x640) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5c94768 [0298.880] RmStartSession () returned 0x0 [0298.882] RmRegisterResources () returned 0x0 [0298.883] RmGetList () returned 0x0 [0298.905] RmShutdown () returned 0x0 [0299.162] RmEndSession () Thread: id = 18 os_tid = 0x1108 [0068.628] GetLastError () returned 0x57 [0068.628] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x357d20 [0068.628] SetLastError (dwErrCode=0x57) [0068.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0070.042] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0071.288] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0077.172] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0078.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0079.292] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0080.293] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0081.326] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0082.378] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0083.640] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0085.104] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0086.296] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0087.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0088.605] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0090.082] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0091.085] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0092.510] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0093.622] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0094.695] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0095.857] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0096.956] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0097.962] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0098.981] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0100.065] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0101.119] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0102.167] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0103.174] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0104.168] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0105.211] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0106.210] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0107.628] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0108.722] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0109.745] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0111.934] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0113.030] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0114.118] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0115.139] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0116.141] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0117.155] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0118.194] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0119.221] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0120.249] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0121.432] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0122.438] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0123.481] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0124.545] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0125.567] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0126.573] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0127.597] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0128.614] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0129.636] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0130.685] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0131.702] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0132.740] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 0 [0133.803] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0133.861] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0133.861] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.861] ReadFile (in: hFile=0x4a4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0133.863] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.863] ReadFile (in: hFile=0x4a4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0133.863] CloseHandle (hObject=0x4a4) returned 1 [0133.863] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0133.863] RmStartSession () returned 0x0 [0133.872] RmRegisterResources () returned 0x0 [0133.879] RmGetList () returned 0x0 [0134.718] RmShutdown () returned 0x0 [0137.528] RmEndSession () returned 0x0 [0137.707] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261708) returned 1 [0137.707] GetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0137.708] SetFileAttributesW (lpFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x20) returned 1 [0137.708] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0137.708] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0137.708] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=42674) returned 1 [0137.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5351768 [0137.708] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4dc5020 [0137.727] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0137.727] ReadFile (in: hFile=0x4ac, lpBuffer=0x4dc5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x4dc5040*, lpNumberOfBytesRead=0x3f2f928*=0xa6b2, lpOverlapped=0x0) returned 1 [0137.752] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0137.752] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.752] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.752] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.752] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.752] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.752] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.752] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.752] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.752] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.752] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.753] CryptEncrypt (in: hKey=0x5261708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5351780*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0137.753] WriteFile (in: hFile=0x4ac, lpBuffer=0x5351780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5351780*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0137.753] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0137.753] WriteFile (in: hFile=0x4ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0137.753] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0137.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4dc5020 | out: hHeap=0x310000) returned 1 [0137.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351768 | out: hHeap=0x310000) returned 1 [0137.758] CloseHandle (hObject=0x4ac) returned 1 [0137.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0137.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c3b0 [0137.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0137.760] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c9a0 [0137.760] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c3b0 | out: hHeap=0x310000) returned 1 [0137.760] MoveFileExW (lpExistingFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.bdCDdCBaAd" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.bdcddcbaad"), dwFlags=0x1) returned 1 [0138.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0138.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0138.035] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.035] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0138.035] GetLastError () returned 0x0 [0138.035] SetLastError (dwErrCode=0x0) [0138.036] GetLastError () returned 0x0 [0138.036] SetLastError (dwErrCode=0x0) [0138.036] GetLastError () returned 0x0 [0138.036] SetLastError (dwErrCode=0x0) [0138.036] GetLastError () returned 0x0 [0138.036] SetLastError (dwErrCode=0x0) [0138.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0138.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0138.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sZcY8NRWe7TT", cchWideChar=12, lpMultiByteStr=0x3f2f760, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sZcY8NRWe7TT", lpUsedDefaultChar=0x0) returned 12 [0138.036] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0138.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x5a90080 [0138.222] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50600e8 [0138.222] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\$getcurrent\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0138.223] WriteFile (in: hFile=0x664, lpBuffer=0x5a90080*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x5a90080*, lpNumberOfBytesWritten=0x3f2f89c*=0xe5f, lpOverlapped=0x0) returned 1 [0138.224] CloseHandle (hObject=0x664) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50600e8 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5a90080 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364ef0 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c9a0 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0138.225] CryptDestroyKey (hKey=0x5261708) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0138.225] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365368 | out: hHeap=0x310000) returned 1 [0138.225] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0138.225] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0138.226] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.226] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0138.227] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.227] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0138.227] CloseHandle (hObject=0x664) returned 1 [0138.228] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060768 [0138.228] RmStartSession () returned 0x0 [0138.233] RmRegisterResources () returned 0x0 [0138.237] RmGetList () returned 0x0 [0140.556] RmShutdown () returned 0x0 [0144.199] RmEndSession () returned 0x0 [0144.199] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261648) returned 1 [0144.200] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0144.200] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0144.200] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0144.200] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0144.200] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=86284) returned 1 [0144.200] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3a1b10 [0144.201] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6b8e020 [0144.543] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0144.543] ReadFile (in: hFile=0x664, lpBuffer=0x6b8e040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6b8e040*, lpNumberOfBytesRead=0x3f2f928*=0x1510c, lpOverlapped=0x0) returned 1 [0144.546] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0144.546] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.546] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.546] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.546] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.546] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.547] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.547] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.548] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.548] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.548] CryptEncrypt (in: hKey=0x5261648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3a1b20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0144.548] WriteFile (in: hFile=0x664, lpBuffer=0x3a1b20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3a1b20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0144.548] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0144.548] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0144.548] WriteFile (in: hFile=0x664, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0144.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b8e020 | out: hHeap=0x310000) returned 1 [0144.728] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a1b10 | out: hHeap=0x310000) returned 1 [0144.728] CloseHandle (hObject=0x664) returned 1 [0144.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0144.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0144.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1c90 [0144.730] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0144.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0144.731] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1032\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0144.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2580 [0144.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0144.731] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0144.731] GetLastError () returned 0x0 [0144.731] SetLastError (dwErrCode=0x0) [0144.731] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eac70 [0144.731] GetLastError () returned 0x0 [0144.731] SetLastError (dwErrCode=0x0) [0144.731] GetLastError () returned 0x0 [0144.731] SetLastError (dwErrCode=0x0) [0144.731] GetLastError () returned 0x0 [0144.732] SetLastError (dwErrCode=0x0) [0144.732] GetLastError () returned 0x0 [0144.732] SetLastError (dwErrCode=0x0) [0144.732] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eac70 | out: hHeap=0x310000) returned 1 [0144.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0144.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NQM", cchWideChar=3, lpMultiByteStr=0x3f2f760, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NQM", lpUsedDefaultChar=0x0) returned 3 [0144.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bac288 [0144.732] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5365220 [0144.732] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1032\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0144.733] WriteFile (in: hFile=0x664, lpBuffer=0x4bac288*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4bac288*, lpNumberOfBytesWritten=0x3f2f89c*=0xe56, lpOverlapped=0x0) returned 1 [0144.734] CloseHandle (hObject=0x664) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5365220 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bac288 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2580 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1c90 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0144.734] CryptDestroyKey (hKey=0x5261648) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060768 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392058 | out: hHeap=0x310000) returned 1 [0144.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18b60 | out: hHeap=0x310000) returned 1 [0144.734] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0144.734] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0144.734] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.735] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0144.769] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.769] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0144.769] CloseHandle (hObject=0x664) returned 1 [0144.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2580 [0144.769] RmStartSession () returned 0x0 [0144.827] RmRegisterResources () returned 0x0 [0144.831] RmGetList () returned 0x0 [0148.304] RmShutdown () returned 0x0 [0150.563] RmEndSession () returned 0x0 [0150.695] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260b88) returned 1 [0150.695] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0150.696] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0150.696] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0150.696] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0150.696] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=79296) returned 1 [0150.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0150.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x590d020 [0150.726] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0150.726] ReadFile (in: hFile=0x664, lpBuffer=0x590d040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x590d040*, lpNumberOfBytesRead=0x3f2f928*=0x135c0, lpOverlapped=0x0) returned 1 [0150.738] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0150.738] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.738] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.738] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.738] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.738] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.738] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.738] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.739] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0150.739] WriteFile (in: hFile=0x664, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0150.740] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0150.740] WriteFile (in: hFile=0x664, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0150.740] WriteFile (in: hFile=0x664, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0150.740] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x590d020 | out: hHeap=0x310000) returned 1 [0150.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0150.745] CloseHandle (hObject=0x664) returned 1 [0150.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0150.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a35e8 [0150.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2518 [0150.747] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a2d68 [0150.747] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a35e8 | out: hHeap=0x310000) returned 1 [0150.747] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\\\588bce7c90097ed212\\1044\\LocalizedData.xml.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0150.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a22a8 [0150.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0150.748] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0150.748] GetLastError () returned 0x0 [0150.748] SetLastError (dwErrCode=0x0) [0150.748] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3890 [0150.748] GetLastError () returned 0x0 [0150.748] SetLastError (dwErrCode=0x0) [0150.748] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.749] SetLastError (dwErrCode=0x0) [0150.749] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba40 [0150.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] GetLastError () returned 0x0 [0150.750] SetLastError (dwErrCode=0x0) [0150.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3890 | out: hHeap=0x310000) returned 1 [0150.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0150.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0150.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vf0DxTAWa6hqTz4zpwUplS", cchWideChar=22, lpMultiByteStr=0x38c390, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vf0DxTAWa6hqTz4zpwUplS", lpUsedDefaultChar=0x0) returned 22 [0150.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba40 | out: hHeap=0x310000) returned 1 [0150.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baee20 [0150.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4bad110 [0150.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5c3a390 [0150.751] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\1044\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0151.074] WriteFile (in: hFile=0x5f8, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe69, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x3f2f89c*=0xe69, lpOverlapped=0x0) returned 1 [0151.075] CloseHandle (hObject=0x5f8) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a390 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baee20 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a22a8 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a2d68 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2518 | out: hHeap=0x310000) returned 1 [0151.076] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0151.076] CryptDestroyKey (hKey=0x5260b88) returned 1 [0152.189] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2580 | out: hHeap=0x310000) returned 1 [0152.189] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0152.189] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18ca0 | out: hHeap=0x310000) returned 1 [0152.189] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0152.189] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0152.189] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.189] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0152.204] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.204] ReadFile (in: hFile=0x4e4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0152.205] CloseHandle (hObject=0x4e4) returned 1 [0152.205] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1d60 [0152.205] RmStartSession () returned 0x0 [0152.207] RmRegisterResources () returned 0x0 [0152.207] RmGetList () returned 0x0 [0152.919] RmShutdown () returned 0x0 [0153.650] RmEndSession () returned 0x0 [0154.130] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260e08) returned 1 [0154.130] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0154.130] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico", dwFileAttributes=0x80) returned 1 [0154.130] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0154.130] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0154.130] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=894) returned 1 [0154.130] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x3e1898 [0154.130] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58cd020 [0154.148] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0154.148] ReadFile (in: hFile=0x484, lpBuffer=0x58cd040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x58cd040*, lpNumberOfBytesRead=0x3f2f928*=0x37e, lpOverlapped=0x0) returned 1 [0154.199] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0154.200] CryptEncrypt (in: hKey=0x5260e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x3e18a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0154.200] WriteFile (in: hFile=0x484, lpBuffer=0x3e18a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3e18a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0154.200] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0154.200] WriteFile (in: hFile=0x484, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0154.200] WriteFile (in: hFile=0x484, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0154.200] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x58cd020 | out: hHeap=0x310000) returned 1 [0154.325] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1898 | out: hHeap=0x310000) returned 1 [0154.325] CloseHandle (hObject=0x484) returned 1 [0154.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0154.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0154.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2038 [0154.326] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0900 [0154.326] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0154.326] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.bdcddcbaad"), dwFlags=0x1) returned 1 [0154.327] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a26b8 [0154.327] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399820 [0154.327] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0154.327] GetLastError () returned 0x0 [0154.327] SetLastError (dwErrCode=0x0) [0154.327] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0154.327] GetLastError () returned 0x0 [0154.327] SetLastError (dwErrCode=0x0) [0154.327] GetLastError () returned 0x0 [0154.327] SetLastError (dwErrCode=0x0) [0154.327] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0154.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0154.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x3f2f760, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0154.327] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0154.327] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0154.327] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0154.328] WriteFile (in: hFile=0x484, lpBuffer=0x4bad110*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4bad110*, lpNumberOfBytesWritten=0x3f2f89c*=0xe54, lpOverlapped=0x0) returned 1 [0154.329] CloseHandle (hObject=0x484) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399820 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a26b8 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0900 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2038 | out: hHeap=0x310000) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0154.329] CryptDestroyKey (hKey=0x5260e08) returned 1 [0154.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a1d60 | out: hHeap=0x310000) returned 1 [0154.330] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060be0 | out: hHeap=0x310000) returned 1 [0154.330] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5d50 | out: hHeap=0x310000) returned 1 [0154.330] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0154.330] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0154.330] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.330] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0154.363] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.363] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0154.363] CloseHandle (hObject=0x484) returned 1 [0154.363] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2378 [0154.363] RmStartSession () returned 0x0 [0156.193] RmRegisterResources () returned 0x0 [0156.199] RmGetList () returned 0x0 [0158.015] RmShutdown () returned 0x0 [0161.705] RmEndSession () returned 0x0 [0162.268] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260c48) returned 1 [0162.269] GetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0162.269] SetFileAttributesW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi", dwFileAttributes=0x80) returned 1 [0162.269] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0162.269] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0162.269] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=1163264) returned 1 [0162.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bc2630 [0162.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6215020 [0162.291] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0162.291] ReadFile (in: hFile=0x6ac, lpBuffer=0x6215040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6215040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0162.766] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0162.766] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.766] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.767] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.767] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.768] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.768] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.769] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.770] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.770] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.771] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.771] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.772] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.772] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.773] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.773] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.774] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.774] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.775] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.775] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.775] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.775] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.775] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.775] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.884] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.886] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.886] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.886] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.886] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.886] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.887] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.888] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.888] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.889] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.889] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.890] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.891] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.891] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.892] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.892] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.893] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.893] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.894] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.895] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.896] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.896] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.896] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.896] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.896] CryptEncrypt (in: hKey=0x5260c48, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bc2640*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0162.896] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bc2640*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bc2640*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0162.896] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0162.896] WriteFile (in: hFile=0x6ac, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0162.896] WriteFile (in: hFile=0x6ac, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0162.897] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6215020 | out: hHeap=0x310000) returned 1 [0163.661] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bc2630 | out: hHeap=0x310000) returned 1 [0163.661] CloseHandle (hObject=0x6ac) returned 1 [0163.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0163.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0810 [0163.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2ac8 [0163.681] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0163.681] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0810 | out: hHeap=0x310000) returned 1 [0163.682] MoveFileExW (lpExistingFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi.bdCDdCBaAd" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.bdcddcbaad"), dwFlags=0x1) returned 1 [0163.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2a60 [0163.682] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0163.682] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3450 [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.683] GetLastError () returned 0x0 [0163.683] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0163.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] GetLastError () returned 0x0 [0163.684] SetLastError (dwErrCode=0x0) [0163.684] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x51f5da8 [0163.684] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] GetLastError () returned 0x0 [0163.685] SetLastError (dwErrCode=0x0) [0163.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3450 | out: hHeap=0x310000) returned 1 [0163.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1d8 [0163.685] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", cchWideChar=30, lpMultiByteStr=0x38c1d8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mdlWwN7DBTEftbjOOlWDzxpw7mZPuw", lpUsedDefaultChar=0x0) returned 30 [0163.685] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51f5da8 | out: hHeap=0x310000) returned 1 [0163.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bad110 [0163.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x4bb0b30 [0163.685] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0163.686] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SxgPNwKy_readme_.txt" (normalized: "c:\\588bce7c90097ed212\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0163.687] WriteFile (in: hFile=0x6ac, lpBuffer=0x4bb0b30*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4bb0b30*, lpNumberOfBytesWritten=0x3f2f89c*=0xe71, lpOverlapped=0x0) returned 1 [0163.688] CloseHandle (hObject=0x6ac) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bad110 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2a60 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2ac8 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0163.688] CryptDestroyKey (hKey=0x5260c48) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060d80 | out: hHeap=0x310000) returned 1 [0163.688] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e58f0 | out: hHeap=0x310000) returned 1 [0163.688] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0163.688] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0163.688] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.689] ReadFile (in: hFile=0x6ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0164.081] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.081] ReadFile (in: hFile=0x6ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0164.081] CloseHandle (hObject=0x6ac) returned 1 [0164.081] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0db0 [0164.082] RmStartSession () returned 0x0 [0165.730] RmRegisterResources () returned 0x0 [0165.734] RmGetList () returned 0x0 [0166.613] RmShutdown () returned 0x0 [0170.356] RmEndSession () returned 0x0 [0170.357] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261948) returned 1 [0170.357] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0170.357] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x20) returned 1 [0170.357] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0170.357] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0170.357] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=69632) returned 1 [0170.357] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4bba570 [0170.358] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6bac020 [0170.682] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0170.682] ReadFile (in: hFile=0x450, lpBuffer=0x6bac040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6bac040*, lpNumberOfBytesRead=0x3f2f928*=0x11000, lpOverlapped=0x0) returned 1 [0170.684] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0170.684] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.684] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.684] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.684] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.685] CryptEncrypt (in: hKey=0x5261948, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4bba580*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0170.685] WriteFile (in: hFile=0x450, lpBuffer=0x4bba580*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4bba580*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0170.686] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0170.686] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0170.686] WriteFile (in: hFile=0x450, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0170.686] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6bac020 | out: hHeap=0x310000) returned 1 [0170.829] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bba570 | out: hHeap=0x310000) returned 1 [0170.829] CloseHandle (hObject=0x450) returned 1 [0170.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0170.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321f40 [0170.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0170.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321198 [0170.832] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321f40 | out: hHeap=0x310000) returned 1 [0170.832] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0170.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3eff28 [0170.832] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0170.832] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0170.832] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a45d8 [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.833] SetLastError (dwErrCode=0x0) [0170.833] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bab0 [0170.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] GetLastError () returned 0x0 [0170.834] SetLastError (dwErrCode=0x0) [0170.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x5212288 [0170.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bab0 | out: hHeap=0x310000) returned 1 [0170.834] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a45d8 | out: hHeap=0x310000) returned 1 [0170.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0170.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0170.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eccP6SvgOOuCqWKgmyr9SIud", cchWideChar=24, lpMultiByteStr=0x38c160, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eccP6SvgOOuCqWKgmyr9SIud", lpUsedDefaultChar=0x0) returned 24 [0170.835] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5212288 | out: hHeap=0x310000) returned 1 [0170.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4bb0b30 [0170.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x4baa578 [0170.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0170.835] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0170.836] WriteFile (in: hFile=0x450, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x3f2f89c*=0xe6b, lpOverlapped=0x0) returned 1 [0170.837] CloseHandle (hObject=0x450) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4bb0b30 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eff28 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321198 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0170.838] CryptDestroyKey (hKey=0x5261948) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0db0 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b238 | out: hHeap=0x310000) returned 1 [0170.838] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3658b8 | out: hHeap=0x310000) returned 1 [0170.838] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0170.838] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0170.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.838] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0170.884] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.884] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0170.884] CloseHandle (hObject=0x450) returned 1 [0170.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0170.884] RmStartSession () returned 0x0 [0170.885] RmRegisterResources () returned 0x0 [0171.068] RmGetList () returned 0x0 [0171.437] RmShutdown () returned 0x0 [0175.105] RmEndSession () returned 0x0 [0175.106] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261448) returned 1 [0175.106] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0175.107] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0175.107] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0175.107] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0175.107] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=69632) returned 1 [0175.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5e3d008 [0175.107] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6586020 [0175.765] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0175.765] ReadFile (in: hFile=0x450, lpBuffer=0x6586040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6586040*, lpNumberOfBytesRead=0x3f2f928*=0x11000, lpOverlapped=0x0) returned 1 [0175.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0175.778] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.778] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.778] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.778] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.778] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.778] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] CryptEncrypt (in: hKey=0x5261448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5e3d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0175.779] WriteFile (in: hFile=0x450, lpBuffer=0x5e3d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5e3d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0175.779] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0175.780] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0175.780] WriteFile (in: hFile=0x450, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0175.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6586020 | out: hHeap=0x310000) returned 1 [0176.110] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5e3d008 | out: hHeap=0x310000) returned 1 [0176.110] CloseHandle (hObject=0x450) returned 1 [0176.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0176.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53216f0 [0176.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4a18 [0176.112] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5321a80 [0176.112] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53216f0 | out: hHeap=0x310000) returned 1 [0176.112] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0176.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0176.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0176.113] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.113] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a3f78 [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.113] GetLastError () returned 0x0 [0176.113] SetLastError (dwErrCode=0x0) [0176.114] GetLastError () returned 0x0 [0176.114] SetLastError (dwErrCode=0x0) [0176.114] GetLastError () returned 0x0 [0176.114] SetLastError (dwErrCode=0x0) [0176.114] GetLastError () returned 0x0 [0176.114] SetLastError (dwErrCode=0x0) [0176.114] GetLastError () returned 0x0 [0176.114] SetLastError (dwErrCode=0x0) [0176.114] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0176.114] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3f78 | out: hHeap=0x310000) returned 1 [0176.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0176.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QjeBlSMi", cchWideChar=8, lpMultiByteStr=0x3f2f760, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QjeBlSMi", lpUsedDefaultChar=0x0) returned 8 [0176.114] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0176.114] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x4baa578 [0176.114] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0176.114] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0176.115] WriteFile (in: hFile=0x450, lpBuffer=0x4baa578*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x4baa578*, lpNumberOfBytesWritten=0x3f2f89c*=0xe5b, lpOverlapped=0x0) returned 1 [0176.116] CloseHandle (hObject=0x450) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397648 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baa578 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321a80 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4a18 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0176.116] CryptDestroyKey (hKey=0x5261448) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9f28 | out: hHeap=0x310000) returned 1 [0176.116] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6290 | out: hHeap=0x310000) returned 1 [0176.116] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0176.117] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0176.117] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.117] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0176.134] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.134] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0176.134] CloseHandle (hObject=0x450) returned 1 [0176.135] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a47f8 [0176.135] RmStartSession () returned 0x0 [0176.137] RmRegisterResources () returned 0x0 [0176.138] RmGetList () returned 0x0 [0180.777] RmShutdown () returned 0x0 [0181.321] RmEndSession () returned 0x0 [0181.849] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260b88) returned 1 [0181.849] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0181.849] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0181.849] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0181.849] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0181.849] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=69632) returned 1 [0181.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bd2088 [0181.850] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x572c020 [0181.868] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0181.868] ReadFile (in: hFile=0x450, lpBuffer=0x572c040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x572c040*, lpNumberOfBytesRead=0x3f2f928*=0x11000, lpOverlapped=0x0) returned 1 [0181.900] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0181.900] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.900] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.900] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.901] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.901] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.902] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.902] CryptEncrypt (in: hKey=0x5260b88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bd20a0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0181.902] WriteFile (in: hFile=0x450, lpBuffer=0x5bd20a0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bd20a0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0181.902] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0181.902] WriteFile (in: hFile=0x450, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0181.902] WriteFile (in: hFile=0x450, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0181.902] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x572c020 | out: hHeap=0x310000) returned 1 [0181.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bd2088 | out: hHeap=0x310000) returned 1 [0181.907] CloseHandle (hObject=0x450) returned 1 [0181.909] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0181.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0181.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0181.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x5327c78 [0181.910] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0181.910] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0181.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4198 [0181.910] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0181.910] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4440 [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.911] SetLastError (dwErrCode=0x0) [0181.911] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bab0 [0181.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.912] GetLastError () returned 0x0 [0181.912] SetLastError (dwErrCode=0x0) [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4baafa8 [0181.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bab0 | out: hHeap=0x310000) returned 1 [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] GetLastError () returned 0x0 [0181.913] SetLastError (dwErrCode=0x0) [0181.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4440 | out: hHeap=0x310000) returned 1 [0181.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0181.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0181.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YymLG954e9jSNEr4fGTQUdOu0cPg", cchWideChar=28, lpMultiByteStr=0x38c520, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YymLG954e9jSNEr4fGTQUdOu0cPg", lpUsedDefaultChar=0x0) returned 28 [0181.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4baafa8 | out: hHeap=0x310000) returned 1 [0181.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0181.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x5409c80 [0181.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0181.913] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0181.914] WriteFile (in: hFile=0x450, lpBuffer=0x5409c80*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x5409c80*, lpNumberOfBytesWritten=0x3f2f89c*=0xe6f, lpOverlapped=0x0) returned 1 [0181.915] CloseHandle (hObject=0x450) returned 1 [0182.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0182.468] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5409c80 | out: hHeap=0x310000) returned 1 [0182.469] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4198 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5327c78 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0182.473] CryptDestroyKey (hKey=0x5260b88) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a47f8 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea3f0 | out: hHeap=0x310000) returned 1 [0182.473] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e61a0 | out: hHeap=0x310000) returned 1 [0182.476] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0182.476] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0182.484] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.484] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0182.499] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.499] ReadFile (in: hFile=0x450, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0182.499] CloseHandle (hObject=0x450) returned 1 [0182.499] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0018 [0182.500] RmStartSession () returned 0x0 [0183.113] RmRegisterResources () returned 0x0 [0183.117] RmGetList () returned 0x0 [0183.701] RmShutdown () returned 0x0 [0188.703] RmEndSession () returned 0x0 [0188.704] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261088) returned 1 [0188.704] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0188.704] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x20) returned 1 [0188.705] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0188.705] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0188.705] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=1052672) returned 1 [0188.705] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5411c60 [0188.706] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6aa7020 [0188.724] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0188.724] ReadFile (in: hFile=0x508, lpBuffer=0x6aa7040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6aa7040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0189.081] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0189.081] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.081] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.082] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.082] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.083] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.084] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.084] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.084] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.084] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.084] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.084] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.084] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.084] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.085] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.085] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.086] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.086] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.087] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.087] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.088] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.088] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.089] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.089] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.090] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.090] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.091] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.091] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.092] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.093] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.093] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.094] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.095] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.095] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.096] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.096] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.097] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.097] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.098] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.098] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] CryptEncrypt (in: hKey=0x5261088, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5411c80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x5411c80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5411c80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0189.099] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0189.099] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0189.108] WriteFile (in: hFile=0x508, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0189.108] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6aa7020 | out: hHeap=0x310000) returned 1 [0189.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5411c60 | out: hHeap=0x310000) returned 1 [0189.641] CloseHandle (hObject=0x508) returned 1 [0189.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0189.662] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0189.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0978 [0189.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4000 [0189.663] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0189.663] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0189.663] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f04c8 [0189.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0189.664] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a4990 [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0189.664] GetLastError () returned 0x0 [0189.664] SetLastError (dwErrCode=0x0) [0189.664] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b730 [0189.665] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.665] SetLastError (dwErrCode=0x0) [0189.665] GetLastError () returned 0x0 [0189.666] SetLastError (dwErrCode=0x0) [0189.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4990 | out: hHeap=0x310000) returned 1 [0189.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0189.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0189.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3p1r5Y6j1RhQxDJosxt", cchWideChar=19, lpMultiByteStr=0x38c160, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3p1r5Y6j1RhQxDJosxt", lpUsedDefaultChar=0x0) returned 19 [0189.666] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b730 | out: hHeap=0x310000) returned 1 [0189.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0189.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x540f3b0 [0189.666] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397528 [0189.666] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0189.667] WriteFile (in: hFile=0x508, lpBuffer=0x540f3b0*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x540f3b0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe66, lpOverlapped=0x0) returned 1 [0189.668] CloseHandle (hObject=0x508) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540f3b0 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f04c8 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4000 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0978 | out: hHeap=0x310000) returned 1 [0189.668] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0189.668] CryptDestroyKey (hKey=0x5261088) returned 1 [0189.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0018 | out: hHeap=0x310000) returned 1 [0189.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19858 | out: hHeap=0x310000) returned 1 [0189.669] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e6dd0 | out: hHeap=0x310000) returned 1 [0189.669] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0189.669] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0189.669] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.669] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0189.831] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.831] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0189.831] CloseHandle (hObject=0x508) returned 1 [0189.831] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x53212c8 [0189.831] RmStartSession () returned 0x0 [0189.855] RmRegisterResources () returned 0x0 [0189.858] RmGetList () returned 0x0 [0191.642] RmShutdown () returned 0x0 [0193.473] RmEndSession () returned 0x0 [0193.474] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52614c8) returned 1 [0193.474] GetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0193.474] SetFileAttributesW (lpFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0193.474] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0193.474] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0193.475] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=69632) returned 1 [0193.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x541fcb8 [0193.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bb020 [0193.829] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0193.829] ReadFile (in: hFile=0x508, lpBuffer=0x64bb040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x64bb040*, lpNumberOfBytesRead=0x3f2f928*=0x11000, lpOverlapped=0x0) returned 1 [0193.831] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0193.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.831] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.831] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.831] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.831] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.831] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.832] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.832] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.832] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.832] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x541fcc0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x541fcc0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x541fcc0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0193.832] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0193.832] WriteFile (in: hFile=0x508, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x508, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0193.833] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64bb020 | out: hHeap=0x310000) returned 1 [0193.939] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x541fcb8 | out: hHeap=0x310000) returned 1 [0193.939] CloseHandle (hObject=0x508) returned 1 [0193.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0193.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53546f8 [0193.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532ad28 [0193.939] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0193.939] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53546f8 | out: hHeap=0x310000) returned 1 [0193.939] MoveFileExW (lpExistingFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.bdCDdCBaAd" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.bdcddcbaad"), dwFlags=0x1) returned 1 [0193.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x532adc0 [0193.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0193.940] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0193.940] GetLastError () returned 0x0 [0193.940] SetLastError (dwErrCode=0x0) [0193.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3a43b8 [0193.940] GetLastError () returned 0x0 [0193.940] SetLastError (dwErrCode=0x0) [0193.940] GetLastError () returned 0x0 [0193.940] SetLastError (dwErrCode=0x0) [0193.940] GetLastError () returned 0x0 [0193.940] SetLastError (dwErrCode=0x0) [0193.940] GetLastError () returned 0x0 [0193.940] SetLastError (dwErrCode=0x0) [0193.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a43b8 | out: hHeap=0x310000) returned 1 [0193.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0193.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwY", cchWideChar=3, lpMultiByteStr=0x3f2f760, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwY", lpUsedDefaultChar=0x0) returned 3 [0193.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x540e528 [0193.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0193.940] CreateFileW (lpFileName="C:\\\\Logs\\SxgPNwKy_readme_.txt" (normalized: "c:\\logs\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0193.941] WriteFile (in: hFile=0x508, lpBuffer=0x540e528*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x540e528*, lpNumberOfBytesWritten=0x3f2f89c*=0xe56, lpOverlapped=0x0) returned 1 [0193.942] CloseHandle (hObject=0x508) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x540e528 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532adc0 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x532ad28 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0193.942] CryptDestroyKey (hKey=0x52614c8) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53212c8 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c870 | out: hHeap=0x310000) returned 1 [0193.942] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44a88 | out: hHeap=0x310000) returned 1 [0193.942] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0193.942] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0193.943] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.943] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0193.944] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.944] ReadFile (in: hFile=0x508, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0193.944] CloseHandle (hObject=0x508) returned 1 [0193.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x6137970 [0193.944] RmStartSession () returned 0x0 [0194.184] RmRegisterResources () returned 0x0 [0194.188] RmGetList () returned 0x0 [0194.890] RmShutdown () returned 0x0 [0196.952] RmEndSession () returned 0x0 [0196.952] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260c88) returned 1 [0196.953] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0196.953] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml", dwFileAttributes=0x20) returned 1 [0196.953] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0196.953] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0196.953] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=4450) returned 1 [0196.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x611de98 [0196.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b8020 [0197.438] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0197.438] ReadFile (in: hFile=0x680, lpBuffer=0x64b8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x64b8040*, lpNumberOfBytesRead=0x3f2f928*=0x1162, lpOverlapped=0x0) returned 1 [0197.448] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0197.449] CryptEncrypt (in: hKey=0x5260c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x611dea0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x611dea0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0197.449] WriteFile (in: hFile=0x680, lpBuffer=0x611dea0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x611dea0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0197.449] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0197.449] WriteFile (in: hFile=0x680, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0197.449] WriteFile (in: hFile=0x680, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0197.449] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b8020 | out: hHeap=0x310000) returned 1 [0197.965] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x611de98 | out: hHeap=0x310000) returned 1 [0197.965] CloseHandle (hObject=0x680) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x5418048 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x4b79dd0 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xd0) returned 0x54168a8 [0197.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5418048 | out: hHeap=0x310000) returned 1 [0197.966] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), lpNewFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.bdCDdCBaAd" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x51ba930 [0197.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51ccab0 [0197.966] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51ccc48 [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.967] SetLastError (dwErrCode=0x0) [0197.967] GetLastError () returned 0x0 [0197.968] SetLastError (dwErrCode=0x0) [0197.968] GetLastError () returned 0x0 [0197.968] SetLastError (dwErrCode=0x0) [0197.968] GetLastError () returned 0x0 [0197.968] SetLastError (dwErrCode=0x0) [0197.968] GetLastError () returned 0x0 [0197.968] SetLastError (dwErrCode=0x0) [0197.968] GetLastError () returned 0x0 [0197.968] SetLastError (dwErrCode=0x0) [0197.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bae8 [0197.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ccc48 | out: hHeap=0x310000) returned 1 [0197.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0197.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0197.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lRTaZqgzay52GZY8", cchWideChar=16, lpMultiByteStr=0x38c3e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lRTaZqgzay52GZY8", lpUsedDefaultChar=0x0) returned 16 [0197.968] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bae8 | out: hHeap=0x310000) returned 1 [0197.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0197.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54ec758 [0197.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6958 [0197.968] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0197.969] WriteFile (in: hFile=0x680, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3f2f89c*=0xe63, lpOverlapped=0x0) returned 1 [0197.970] CloseHandle (hObject=0x680) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6958 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ccab0 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ba930 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54168a8 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b79dd0 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0197.970] CryptDestroyKey (hKey=0x5260c88) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6137970 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390b10 | out: hHeap=0x310000) returned 1 [0197.970] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b44d58 | out: hHeap=0x310000) returned 1 [0197.970] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0197.970] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0197.971] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.971] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0197.974] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.974] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0197.974] CloseHandle (hObject=0x680) returned 1 [0197.974] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a8c08 [0197.974] RmStartSession () returned 0x0 [0197.976] RmRegisterResources () returned 0x0 [0197.980] RmGetList () returned 0x0 [0198.666] RmShutdown () returned 0x0 [0200.306] RmEndSession () returned 0x0 [0200.307] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261948) returned 1 [0200.307] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0200.307] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", dwFileAttributes=0x20) returned 0 [0200.307] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.307] CryptDestroyKey (hKey=0x5261948) returned 1 [0200.308] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a8c08 | out: hHeap=0x310000) returned 1 [0200.308] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cad0 | out: hHeap=0x310000) returned 1 [0200.308] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08320 | out: hHeap=0x310000) returned 1 [0200.308] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0200.309] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0200.309] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.309] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0200.314] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.314] ReadFile (in: hFile=0x680, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0200.314] CloseHandle (hObject=0x680) returned 1 [0200.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x51b6220 [0200.314] RmStartSession () returned 0x0 [0200.316] RmRegisterResources () returned 0x0 [0200.320] RmGetList () returned 0x0 [0203.412] RmShutdown () returned 0x0 [0207.210] RmEndSession () returned 0x0 [0207.211] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261888) returned 1 [0207.211] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0207.211] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui", dwFileAttributes=0x20) returned 0 [0207.211] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.212] CryptDestroyKey (hKey=0x5261888) returned 1 [0207.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b6220 | out: hHeap=0x310000) returned 1 [0207.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93498 | out: hHeap=0x310000) returned 1 [0207.212] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c07f10 | out: hHeap=0x310000) returned 1 [0207.212] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0207.212] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0207.407] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.407] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0207.475] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.475] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0207.475] CloseHandle (hObject=0x664) returned 1 [0207.475] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x53ebd28 [0207.475] RmStartSession () returned 0x0 [0207.478] RmRegisterResources () returned 0x0 [0207.478] RmGetList () returned 0x0 [0207.517] RmShutdown () returned 0x0 [0212.084] RmEndSession () returned 0x0 [0212.085] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x35d7c8) returned 1 [0212.085] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0212.085] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", dwFileAttributes=0x20) returned 0 [0212.085] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.085] CryptDestroyKey (hKey=0x35d7c8) returned 1 [0212.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53ebd28 | out: hHeap=0x310000) returned 1 [0212.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc718 | out: hHeap=0x310000) returned 1 [0212.086] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c08460 | out: hHeap=0x310000) returned 1 [0212.086] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0212.086] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0212.086] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.086] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0212.132] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.132] ReadFile (in: hFile=0x664, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0212.132] CloseHandle (hObject=0x664) returned 1 [0212.132] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93d20 [0212.132] RmStartSession () returned 0x0 [0212.136] RmRegisterResources () returned 0x0 [0212.140] RmGetList () returned 0x0 [0212.774] RmShutdown () returned 0x0 [0215.519] RmEndSession () returned 0x0 [0215.520] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261948) returned 1 [0215.520] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0215.520] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0215.520] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.521] CryptDestroyKey (hKey=0x5261948) returned 1 [0215.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93d20 | out: hHeap=0x310000) returned 1 [0215.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0215.521] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a58d0 | out: hHeap=0x310000) returned 1 [0215.521] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0215.521] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0215.534] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.534] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0215.536] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.536] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0215.536] CloseHandle (hObject=0x484) returned 1 [0215.536] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0215.536] RmStartSession () returned 0x0 [0216.250] RmRegisterResources () returned 0x0 [0216.426] RmGetList () returned 0x0 [0217.433] RmShutdown () returned 0x0 [0217.973] RmEndSession () returned 0x0 [0217.974] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52610c8) returned 1 [0217.974] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0217.974] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml", dwFileAttributes=0x20) returned 0 [0217.974] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.974] CryptDestroyKey (hKey=0x52610c8) returned 1 [0217.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0217.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb1c0 | out: hHeap=0x310000) returned 1 [0217.974] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a6050 | out: hHeap=0x310000) returned 1 [0217.974] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0217.974] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0217.975] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.975] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0217.992] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.992] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0217.992] CloseHandle (hObject=0x484) returned 1 [0217.993] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be060 [0217.993] RmStartSession () returned 0x0 [0217.997] RmRegisterResources () returned 0x0 [0218.000] RmGetList () returned 0x0 [0218.873] RmShutdown () returned 0x0 [0220.363] RmEndSession () returned 0x0 [0220.364] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52610c8) returned 1 [0220.364] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0220.364] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml", dwFileAttributes=0x20) returned 0 [0220.364] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.365] CryptDestroyKey (hKey=0x52610c8) returned 1 [0220.365] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0220.365] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0220.365] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53a5ec0 | out: hHeap=0x310000) returned 1 [0220.365] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0220.365] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0220.365] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.365] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0220.391] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.391] ReadFile (in: hFile=0x484, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0220.391] CloseHandle (hObject=0x484) returned 1 [0220.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93690 [0220.392] RmStartSession () returned 0x0 [0220.395] RmRegisterResources () returned 0x0 [0220.395] RmGetList () returned 0x0 [0221.557] RmShutdown () returned 0x0 [0225.099] RmEndSession () returned 0x0 [0225.615] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52610c8) returned 1 [0225.615] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0225.615] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", dwFileAttributes=0x20) returned 0 [0225.615] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0225.615] CryptDestroyKey (hKey=0x52610c8) returned 1 [0225.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93690 | out: hHeap=0x310000) returned 1 [0225.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3edf58 | out: hHeap=0x310000) returned 1 [0225.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14a60 | out: hHeap=0x310000) returned 1 [0225.615] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0225.615] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0225.625] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.625] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0225.626] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.626] ReadFile (in: hFile=0x52c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0225.626] CloseHandle (hObject=0x52c) returned 1 [0225.626] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0225.626] RmStartSession () returned 0x0 [0225.934] RmRegisterResources () returned 0x0 [0225.935] RmGetList () returned 0x0 [0226.045] RmShutdown () returned 0x0 [0227.334] RmEndSession () returned 0x0 [0228.441] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260b48) returned 1 [0228.441] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0228.441] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x20) returned 0 [0228.441] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0228.441] CryptDestroyKey (hKey=0x5260b48) returned 1 [0228.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0228.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ee888 | out: hHeap=0x310000) returned 1 [0228.441] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14dd0 | out: hHeap=0x310000) returned 1 [0228.441] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0228.441] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0228.442] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.442] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0228.443] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.443] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0228.443] CloseHandle (hObject=0x4ac) returned 1 [0228.443] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c937e0 [0228.443] RmStartSession () returned 0x0 [0228.452] RmRegisterResources () returned 0x0 [0228.453] RmGetList () returned 0x0 [0228.716] RmShutdown () returned 0x0 [0231.679] RmEndSession () returned 0x0 [0232.078] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52614c8) returned 1 [0232.078] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0232.078] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x20) returned 0 [0232.078] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.078] CryptDestroyKey (hKey=0x52614c8) returned 1 [0232.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c937e0 | out: hHeap=0x310000) returned 1 [0232.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ef110 | out: hHeap=0x310000) returned 1 [0232.078] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c14c40 | out: hHeap=0x310000) returned 1 [0232.078] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0232.079] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0232.079] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.079] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0232.128] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.128] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0232.128] CloseHandle (hObject=0x4ac) returned 1 [0232.128] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2bc0 [0232.128] RmStartSession () returned 0x0 [0232.129] RmRegisterResources () returned 0x0 [0232.130] RmGetList () returned 0x0 [0232.298] RmShutdown () returned 0x0 [0235.695] RmEndSession () returned 0x0 [0236.022] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260f08) returned 1 [0236.022] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0236.022] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", dwFileAttributes=0x20) returned 0 [0236.022] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.022] CryptDestroyKey (hKey=0x5260f08) returned 1 [0236.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2bc0 | out: hHeap=0x310000) returned 1 [0236.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5571b00 | out: hHeap=0x310000) returned 1 [0236.022] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5572928 | out: hHeap=0x310000) returned 1 [0236.022] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0236.022] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0236.022] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.022] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0236.036] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.036] ReadFile (in: hFile=0x4ac, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0236.036] CloseHandle (hObject=0x4ac) returned 1 [0236.036] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0236.036] RmStartSession () returned 0x0 [0236.319] RmRegisterResources () returned 0x0 [0236.319] RmGetList () returned 0x0 [0236.400] RmShutdown () returned 0x0 [0237.828] RmEndSession () returned 0x0 [0238.422] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52612c8) returned 1 [0238.422] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0238.422] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", dwFileAttributes=0x20) returned 1 [0238.422] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0238.423] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0238.423] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=3036922) returned 1 [0238.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b56f20 [0238.423] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e0020 [0238.441] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0238.441] ReadFile (in: hFile=0x6a8, lpBuffer=0x49e0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x49e0040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0238.472] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0238.472] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.472] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.473] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.473] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.473] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.479] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.479] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.480] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.480] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.481] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.481] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.482] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.483] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.484] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.484] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.485] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.485] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.486] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.486] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.487] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.488] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.489] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.490] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.490] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0238.491] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0238.491] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.091] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.091] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.091] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.091] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.094] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.095] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.095] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.096] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.096] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.097] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.098] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0239.098] ReadFile (in: hFile=0x6a8, lpBuffer=0x49e0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x49e0040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0239.992] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.993] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.993] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.994] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.994] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.995] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.995] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.996] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.996] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.997] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.997] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.998] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.998] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0239.999] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0239.999] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.000] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.000] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.001] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.001] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.002] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.002] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.002] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.002] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.002] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.002] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.002] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.002] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.002] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.002] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.003] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.003] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.004] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.004] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.005] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.005] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.006] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.006] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.007] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.007] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.008] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.008] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.008] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.008] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.008] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.008] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.009] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.009] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.010] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.010] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.011] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.011] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.011] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.011] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.011] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.011] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.011] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0240.011] ReadFile (in: hFile=0x6a8, lpBuffer=0x49e0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x49e0040*, lpNumberOfBytesRead=0x3f2f928*=0xe56fa, lpOverlapped=0x0) returned 1 [0240.881] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0240.881] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.881] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.881] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.881] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.881] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.881] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.882] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.882] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.883] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.884] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.884] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.885] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.885] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.886] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.886] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.887] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.887] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.888] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.888] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.889] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.889] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.890] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.890] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.891] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.891] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.892] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.892] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.893] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.893] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.893] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.893] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.902] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.903] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.903] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.904] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.904] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.905] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.905] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.906] CryptEncrypt (in: hKey=0x52612c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b56f40*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0240.906] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b56f40*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b56f40*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0240.907] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0240.907] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0240.907] WriteFile (in: hFile=0x6a8, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0240.907] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e0020 | out: hHeap=0x310000) returned 1 [0240.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b56f20 | out: hHeap=0x310000) returned 1 [0240.913] CloseHandle (hObject=0x6a8) returned 1 [0240.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0240.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0240.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0240.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd978 [0240.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0240.913] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0240.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d196f0 [0240.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392128 [0240.914] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.914] SetLastError (dwErrCode=0x0) [0240.914] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b500 [0240.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] GetLastError () returned 0x0 [0240.915] SetLastError (dwErrCode=0x0) [0240.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x52e5980 [0240.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0240.916] GetLastError () returned 0x0 [0240.916] SetLastError (dwErrCode=0x0) [0240.916] GetLastError () returned 0x0 [0240.916] SetLastError (dwErrCode=0x0) [0240.916] GetLastError () returned 0x0 [0240.916] SetLastError (dwErrCode=0x0) [0240.916] GetLastError () returned 0x0 [0240.916] SetLastError (dwErrCode=0x0) [0240.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0240.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0240.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0240.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", cchWideChar=28, lpMultiByteStr=0x38c0c0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4EYXNQ2EkudRawU8KrAju0rMMzPp", lpUsedDefaultChar=0x0) returned 28 [0240.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52e5980 | out: hHeap=0x310000) returned 1 [0240.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0240.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e8d38 [0240.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bda00 [0240.916] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0240.916] WriteFile (in: hFile=0x6a8, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe6f, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3f2f89c*=0xe6f, lpOverlapped=0x0) returned 1 [0240.917] CloseHandle (hObject=0x6a8) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bda00 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392128 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d196f0 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd978 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0240.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0240.918] CryptDestroyKey (hKey=0x52612c8) returned 1 [0240.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0240.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a2a0 | out: hHeap=0x310000) returned 1 [0240.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x55727e8 | out: hHeap=0x310000) returned 1 [0240.918] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0240.918] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0240.919] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.919] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0240.920] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.920] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0240.920] CloseHandle (hObject=0x6a8) returned 1 [0240.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd648 [0240.921] RmStartSession () returned 0x0 [0240.923] RmRegisterResources () returned 0x0 [0241.402] RmGetList () returned 0x0 [0241.451] RmShutdown () returned 0x0 [0241.846] RmEndSession () returned 0x0 [0242.091] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52619c8) returned 1 [0242.091] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0242.091] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif", dwFileAttributes=0x20) returned 1 [0242.092] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0242.092] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0242.092] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=15276) returned 1 [0242.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b4cf00 [0242.092] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4d44020 [0242.110] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0242.110] ReadFile (in: hFile=0x6a8, lpBuffer=0x4d44040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x4d44040*, lpNumberOfBytesRead=0x3f2f928*=0x3bac, lpOverlapped=0x0) returned 1 [0242.142] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0242.143] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0242.143] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0242.143] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4b4cf20*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x4b4cf20*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0242.143] WriteFile (in: hFile=0x6a8, lpBuffer=0x4b4cf20*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x4b4cf20*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0242.143] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0242.143] WriteFile (in: hFile=0x6a8, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0242.144] WriteFile (in: hFile=0x6a8, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0242.144] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4d44020 | out: hHeap=0x310000) returned 1 [0242.148] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4b4cf00 | out: hHeap=0x310000) returned 1 [0242.148] CloseHandle (hObject=0x6a8) returned 1 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b29f8 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0242.149] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b29f8 | out: hHeap=0x310000) returned 1 [0242.149] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.bdcddcbaad"), dwFlags=0x1) returned 1 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be0e8 [0242.149] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0242.150] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0242.150] GetLastError () returned 0x0 [0242.150] SetLastError (dwErrCode=0x0) [0242.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0242.150] GetLastError () returned 0x0 [0242.150] SetLastError (dwErrCode=0x0) [0242.150] GetLastError () returned 0x0 [0242.150] SetLastError (dwErrCode=0x0) [0242.150] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0242.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0242.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x3f2f760, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0242.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0242.150] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0242.150] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0242.151] WriteFile (in: hFile=0x6a8, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3f2f89c*=0xe54, lpOverlapped=0x0) returned 1 [0242.152] CloseHandle (hObject=0x6a8) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be0e8 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0242.152] CryptDestroyKey (hKey=0x52619c8) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd648 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a3120 | out: hHeap=0x310000) returned 1 [0242.152] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53523d0 | out: hHeap=0x310000) returned 1 [0242.152] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0242.152] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0242.152] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.152] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0242.274] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.274] ReadFile (in: hFile=0x6a8, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0242.274] CloseHandle (hObject=0x6a8) returned 1 [0242.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a0c8 [0242.274] RmStartSession () returned 0x0 [0242.481] RmRegisterResources () returned 0x0 [0242.481] RmGetList () returned 0x0 [0243.535] RmShutdown () returned 0x0 [0243.577] RmEndSession () returned 0x0 [0243.577] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261a08) returned 1 [0243.577] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0243.578] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar", dwFileAttributes=0x20) returned 1 [0243.578] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0243.578] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0243.578] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=18246297) returned 1 [0243.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d6a020 [0243.578] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64bc020 [0243.966] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0243.966] ReadFile (in: hFile=0x548, lpBuffer=0x64bc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x64bc040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0243.974] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0243.974] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.974] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.980] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.980] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.981] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.981] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.982] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.982] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.983] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.983] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.984] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.984] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.985] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.985] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.986] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.986] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.987] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.987] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.988] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.988] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.989] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.989] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.990] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.990] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.991] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.992] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.992] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.993] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.993] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.994] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.994] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.995] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.995] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.996] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.996] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.997] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.997] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.998] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.998] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.998] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.998] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0243.998] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0243.998] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0243.998] ReadFile (in: hFile=0x548, lpBuffer=0x64bc040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x64bc040*, lpNumberOfBytesRead=0x3f2f928*=0x100000, lpOverlapped=0x0) returned 1 [0244.445] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0244.445] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.446] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.446] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.447] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.447] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.448] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.448] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.449] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.449] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.450] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.450] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.451] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.451] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.452] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.452] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.453] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.453] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.454] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.454] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.455] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.455] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.456] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.456] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.457] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.457] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.458] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.458] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.459] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.459] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.460] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.460] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.461] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.461] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.462] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.462] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.462] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.462] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.462] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.462] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0244.462] CryptEncrypt (in: hKey=0x5261a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5d6a040*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0244.462] WriteFile (in: hFile=0x548, lpBuffer=0x5d6a040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5d6a040*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0250.718] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.721] GetLastError () returned 0x0 [0250.721] SetLastError (dwErrCode=0x0) [0250.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b688 [0250.722] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.722] GetLastError () returned 0x0 [0250.722] SetLastError (dwErrCode=0x0) [0250.723] GetLastError () returned 0x0 [0250.723] SetLastError (dwErrCode=0x0) [0250.723] GetLastError () returned 0x0 [0250.723] SetLastError (dwErrCode=0x0) [0250.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x50ed650 [0250.723] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b688 | out: hHeap=0x310000) returned 1 [0250.723] GetLastError () returned 0x0 [0250.723] SetLastError (dwErrCode=0x0) [0250.723] GetLastError () returned 0x0 [0250.723] SetLastError (dwErrCode=0x0) [0250.723] GetLastError () returned 0x0 [0250.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0250.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0250.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", cchWideChar=29, lpMultiByteStr=0x38c160, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cS7dCuPn93kcmhNU2crOlADbUkC2f", lpUsedDefaultChar=0x0) returned 29 [0250.723] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50ed650 | out: hHeap=0x310000) returned 1 [0250.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0250.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe80) returned 0x54e9bc0 [0250.723] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3670 [0250.723] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0250.724] WriteFile (in: hFile=0x548, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe70, lpOverlapped=0x0) returned 1 [0250.725] CloseHandle (hObject=0x548) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3670 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19768 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19a38 | out: hHeap=0x310000) returned 1 [0250.725] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0250.725] CryptDestroyKey (hKey=0x5261a08) returned 1 [0250.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a0c8 | out: hHeap=0x310000) returned 1 [0250.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a048 | out: hHeap=0x310000) returned 1 [0250.726] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53521a0 | out: hHeap=0x310000) returned 1 [0250.726] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0250.726] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0250.726] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.726] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0250.736] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.736] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0250.736] CloseHandle (hObject=0x548) returned 1 [0250.736] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93888 [0250.736] RmStartSession () returned 0x0 [0250.738] RmRegisterResources () returned 0x0 [0250.738] RmGetList () returned 0x0 [0251.147] RmShutdown () returned 0x0 [0251.398] RmEndSession () returned 0x0 [0251.399] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52614c8) returned 1 [0251.399] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0251.399] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties", dwFileAttributes=0x20) returned 1 [0251.399] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0251.399] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0251.399] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=14630) returned 1 [0251.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x54cfe68 [0251.399] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x64b8020 [0252.025] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0252.025] ReadFile (in: hFile=0x548, lpBuffer=0x64b8040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x64b8040*, lpNumberOfBytesRead=0x3f2f928*=0x3926, lpOverlapped=0x0) returned 1 [0252.027] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0252.027] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0252.027] WriteFile (in: hFile=0x548, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0252.027] CryptEncrypt (in: hKey=0x52614c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54cfe80*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x54cfe80*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0252.027] WriteFile (in: hFile=0x548, lpBuffer=0x54cfe80*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x54cfe80*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0252.028] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0252.028] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0252.028] WriteFile (in: hFile=0x548, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0252.028] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x64b8020 | out: hHeap=0x310000) returned 1 [0253.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54cfe68 | out: hHeap=0x310000) returned 1 [0253.368] CloseHandle (hObject=0x548) returned 1 [0253.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0253.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dba28 [0253.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0253.368] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3dc940 [0253.368] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dba28 | out: hHeap=0x310000) returned 1 [0253.368] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.bdcddcbaad"), dwFlags=0x1) returned 1 [0253.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0253.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a320 [0253.369] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0253.369] GetLastError () returned 0x0 [0253.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0253.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LCKq", cchWideChar=4, lpMultiByteStr=0x3f2f760, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LCKq", lpUsedDefaultChar=0x0) returned 4 [0253.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eaa48 [0253.369] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2fe8 [0253.369] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0253.370] WriteFile (in: hFile=0x548, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3f2f89c*=0xe57, lpOverlapped=0x0) returned 1 [0253.371] CloseHandle (hObject=0x548) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2fe8 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a320 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc940 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0253.371] CryptDestroyKey (hKey=0x52614c8) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93888 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0253.371] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5352ce0 | out: hHeap=0x310000) returned 1 [0253.371] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0253.371] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0253.372] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.372] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0253.373] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.373] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0253.373] CloseHandle (hObject=0x548) returned 1 [0253.373] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b38d0 [0253.373] RmStartSession () returned 0x0 [0253.376] RmRegisterResources () returned 0x0 [0253.377] RmGetList () returned 0x0 [0253.405] RmShutdown () returned 0x0 [0254.151] RmEndSession () returned 0x0 [0254.152] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261748) returned 1 [0254.152] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0254.152] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar", dwFileAttributes=0x20) returned 1 [0254.152] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0254.152] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0254.152] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=3527) returned 1 [0254.152] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5bb4078 [0254.153] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49ef020 [0254.525] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0254.525] ReadFile (in: hFile=0x548, lpBuffer=0x49ef040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x49ef040*, lpNumberOfBytesRead=0x3f2f928*=0xdc7, lpOverlapped=0x0) returned 1 [0254.527] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0254.527] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5bb4080*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5bb4080*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0254.527] WriteFile (in: hFile=0x548, lpBuffer=0x5bb4080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5bb4080*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0254.527] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0254.527] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0254.527] WriteFile (in: hFile=0x548, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0254.527] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49ef020 | out: hHeap=0x310000) returned 1 [0254.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5bb4078 | out: hHeap=0x310000) returned 1 [0254.925] CloseHandle (hObject=0x548) returned 1 [0254.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0254.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c935e8 [0254.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3118 [0254.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c93c78 [0254.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c935e8 | out: hHeap=0x310000) returned 1 [0254.926] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.bdcddcbaad"), dwFlags=0x1) returned 1 [0254.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3410 [0254.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19b28 [0254.926] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0254.926] GetLastError () returned 0x0 [0254.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0254.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx231C421W", cchWideChar=10, lpMultiByteStr=0x3f2f760, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx231C421W", lpUsedDefaultChar=0x0) returned 10 [0254.927] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0254.927] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0254.927] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3540 [0254.927] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0254.928] WriteFile (in: hFile=0x548, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3f2f89c*=0xe5d, lpOverlapped=0x0) returned 1 [0254.928] CloseHandle (hObject=0x548) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3540 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19b28 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3410 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c93c78 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3118 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0254.929] CryptDestroyKey (hKey=0x5261748) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b38d0 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5570470 | out: hHeap=0x310000) returned 1 [0254.929] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53535f0 | out: hHeap=0x310000) returned 1 [0254.929] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0254.929] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0254.929] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.929] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0254.972] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.972] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0254.972] CloseHandle (hObject=0x548) returned 1 [0254.972] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19e70 [0254.972] RmStartSession () returned 0x0 [0254.974] RmRegisterResources () returned 0x0 [0254.974] RmGetList () returned 0x0 [0255.015] RmShutdown () returned 0x0 [0256.098] RmEndSession () returned 0x0 [0256.170] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52618c8) returned 1 [0256.170] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0256.170] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", dwFileAttributes=0x20) returned 1 [0256.171] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0256.171] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0256.171] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=8400) returned 1 [0256.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b6b008 [0256.171] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x5818020 [0256.189] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0256.189] ReadFile (in: hFile=0x548, lpBuffer=0x5818040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x5818040*, lpNumberOfBytesRead=0x3f2f928*=0x20d0, lpOverlapped=0x0) returned 1 [0256.323] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0256.323] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0256.323] WriteFile (in: hFile=0x548, lpBuffer=0x6b6b020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b6b020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0256.324] CryptEncrypt (in: hKey=0x52618c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b6b020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b6b020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0256.324] WriteFile (in: hFile=0x548, lpBuffer=0x6b6b020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b6b020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0256.324] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0256.324] WriteFile (in: hFile=0x548, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0256.324] WriteFile (in: hFile=0x548, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0256.324] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5818020 | out: hHeap=0x310000) returned 1 [0256.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b6b008 | out: hHeap=0x310000) returned 1 [0256.329] CloseHandle (hObject=0x548) returned 1 [0256.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0256.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0256.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19ab0 [0256.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be418 [0256.330] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0256.330] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), lpNewFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.bdCDdCBaAd" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.bdcddcbaad"), dwFlags=0x1) returned 1 [0256.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19678 [0256.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0256.330] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0256.330] GetLastError () returned 0x0 [0256.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0256.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uZdPMPqLr8IS7", cchWideChar=13, lpMultiByteStr=0x3f2f760, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uZdPMPqLr8IS7", lpUsedDefaultChar=0x0) returned 13 [0256.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0256.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e9bc0 [0256.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eb8d0 [0256.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51be1f8 [0256.331] CreateFileW (lpFileName="C:\\\\Program Files\\Java\\jre1.8.0_144\\lib\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0256.332] WriteFile (in: hFile=0x548, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe60, lpOverlapped=0x0) returned 1 [0256.333] CloseHandle (hObject=0x548) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be1f8 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19678 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19ab0 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0256.333] CryptDestroyKey (hKey=0x52618c8) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19e70 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39a30 | out: hHeap=0x310000) returned 1 [0256.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351c00 | out: hHeap=0x310000) returned 1 [0256.333] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0256.333] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0256.333] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.333] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0256.357] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.357] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0256.357] CloseHandle (hObject=0x548) returned 1 [0256.358] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d19858 [0256.358] RmStartSession () returned 0x0 [0256.360] RmRegisterResources () returned 0x0 [0256.361] RmGetList () returned 0x0 [0257.026] RmShutdown () returned 0x0 [0258.617] RmEndSession () returned 0x0 [0258.618] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261208) returned 1 [0258.618] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0258.618] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\AppXManifest.xml", dwFileAttributes=0x20) returned 1 [0258.618] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0258.618] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0258.618] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=5944055) returned 1 [0258.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5d60010 [0258.618] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x7c05020 [0262.818] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0262.818] GetLastError () returned 0x0 [0262.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0262.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="twtv", cchWideChar=4, lpMultiByteStr=0x3f2f760, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="twtv", lpUsedDefaultChar=0x0) returned 4 [0262.818] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54eb8d0 [0262.818] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x5d1a1b8 [0262.818] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0262.819] WriteFile (in: hFile=0x548, lpBuffer=0x54eb8d0*, nNumberOfBytesToWrite=0xe57, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54eb8d0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe57, lpOverlapped=0x0) returned 1 [0262.820] CloseHandle (hObject=0x548) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d1a1b8 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eb8d0 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d198d0 | out: hHeap=0x310000) returned 1 [0262.820] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0262.820] CryptDestroyKey (hKey=0x5261208) returned 1 [0262.821] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19858 | out: hHeap=0x310000) returned 1 [0262.821] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c3a138 | out: hHeap=0x310000) returned 1 [0262.821] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351b60 | out: hHeap=0x310000) returned 1 [0262.821] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0262.821] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0262.821] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.821] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0262.823] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.823] ReadFile (in: hFile=0x548, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0262.823] CloseHandle (hObject=0x548) returned 1 [0262.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x5f046a8 [0262.823] RmStartSession () returned 0x0 [0263.723] RmRegisterResources () returned 0x0 [0263.729] RmGetList () returned 0x0 [0264.825] RmShutdown () returned 0x0 [0267.738] RmEndSession () returned 0x0 [0267.739] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5260bc8) returned 1 [0267.739] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0267.739] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x220) returned 1 [0267.740] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0267.740] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0267.740] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=399528) returned 1 [0267.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6b47050 [0267.740] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78df020 [0268.754] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0268.754] ReadFile (in: hFile=0x690, lpBuffer=0x78df040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x78df040*, lpNumberOfBytesRead=0x3f2f928*=0x618a8, lpOverlapped=0x0) returned 1 [0268.758] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0268.758] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.759] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.759] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.760] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.760] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.761] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.761] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.762] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.762] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.763] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.763] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.764] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.764] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.765] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.765] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.766] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.766] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.766] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.766] CryptEncrypt (in: hKey=0x5260bc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6b47060*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0268.766] WriteFile (in: hFile=0x690, lpBuffer=0x6b47060*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6b47060*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0268.766] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0268.766] WriteFile (in: hFile=0x690, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0268.766] WriteFile (in: hFile=0x690, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0268.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x78df020 | out: hHeap=0x310000) returned 1 [0268.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6b47050 | out: hHeap=0x310000) returned 1 [0268.867] CloseHandle (hObject=0x690) returned 1 [0268.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0268.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xf0) returned 0x5ccd7a0 [0268.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x4ba5760 [0268.867] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xf0) returned 0x5ccde68 [0268.867] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ccd7a0 | out: hHeap=0x310000) returned 1 [0268.867] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.bdcddcbaad"), dwFlags=0x1) returned 1 [0268.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe0) returned 0x4ba1538 [0268.868] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x3f0270 [0268.868] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0268.868] GetLastError () returned 0x0 [0268.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0268.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0268.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1f15BUaqm7XqtONc8btxaBe3", cchWideChar=24, lpMultiByteStr=0x38c390, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1f15BUaqm7XqtONc8btxaBe3", lpUsedDefaultChar=0x0) returned 24 [0268.869] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5351b10 | out: hHeap=0x310000) returned 1 [0268.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0268.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54eaa48 [0268.869] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c939d8 [0268.869] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\PackageManifests\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0268.870] WriteFile (in: hFile=0x690, lpBuffer=0x54eaa48*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54eaa48*, lpNumberOfBytesWritten=0x3f2f89c*=0xe6b, lpOverlapped=0x0) returned 1 [0268.870] CloseHandle (hObject=0x690) returned 1 [0268.870] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c939d8 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54eaa48 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0270 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba1538 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5ccde68 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4ba5760 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0268.871] CryptDestroyKey (hKey=0x5260bc8) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5f046a8 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53487d8 | out: hHeap=0x310000) returned 1 [0268.871] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c194c0 | out: hHeap=0x310000) returned 1 [0268.871] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0268.871] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0268.871] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.871] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0268.873] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0268.873] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0268.873] CloseHandle (hObject=0x690) returned 1 [0268.874] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0268.874] RmStartSession () returned 0x0 [0268.875] RmRegisterResources () returned 0x0 [0268.875] RmGetList () returned 0x0 [0270.631] RmShutdown () returned 0x0 [0272.881] RmEndSession () returned 0x0 [0272.948] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52611c8) returned 1 [0272.948] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0272.948] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF", dwFileAttributes=0x220) returned 1 [0272.948] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0272.948] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0272.948] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=3140) returned 1 [0272.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0272.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6217020 [0272.981] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0272.981] GetLastError () returned 0x0 [0272.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0272.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xAw10", cchWideChar=5, lpMultiByteStr=0x3f2f760, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xAw10", lpUsedDefaultChar=0x0) returned 5 [0272.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0272.982] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0272.982] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0272.983] WriteFile (in: hFile=0x690, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3f2f89c*=0xe58, lpOverlapped=0x0) returned 1 [0272.984] CloseHandle (hObject=0x690) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be060 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b32e0 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53cfec8 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0272.984] CryptDestroyKey (hKey=0x52611c8) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4be8 | out: hHeap=0x310000) returned 1 [0272.984] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e3630 | out: hHeap=0x310000) returned 1 [0272.984] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0272.984] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0272.984] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0272.984] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0273.008] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0273.008] ReadFile (in: hFile=0x690, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0273.008] CloseHandle (hObject=0x690) returned 1 [0273.008] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0273.008] RmStartSession () returned 0x0 [0273.079] RmRegisterResources () returned 0x0 [0273.080] RmGetList () returned 0x0 [0273.201] RmShutdown () returned 0x0 [0273.949] RmEndSession () returned 0x0 [0273.950] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261208) returned 1 [0273.950] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0273.950] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF", dwFileAttributes=0x220) returned 1 [0273.950] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0273.950] CryptEncrypt (in: hKey=0x5261208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0273.950] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=3120) returned 1 [0273.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x4b8d330 [0273.950] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x78dd020 [0274.488] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0274.488] GetLastError () returned 0x0 [0274.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0274.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JI3sLVWO", cchWideChar=8, lpMultiByteStr=0x3f2f760, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JI3sLVWO", lpUsedDefaultChar=0x0) returned 8 [0274.488] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0274.488] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ec758 [0274.489] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3efce0 [0274.489] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0274.490] WriteFile (in: hFile=0x4d4, lpBuffer=0x54ec758*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54ec758*, lpNumberOfBytesWritten=0x3f2f89c*=0xe5b, lpOverlapped=0x0) returned 1 [0274.491] CloseHandle (hObject=0x4d4) returned 1 [0274.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3efce0 | out: hHeap=0x310000) returned 1 [0274.491] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ec758 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53c9188 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3b30 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1d8 | out: hHeap=0x310000) returned 1 [0274.492] CryptDestroyKey (hKey=0x5261208) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a4f78 | out: hHeap=0x310000) returned 1 [0274.492] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2e60 | out: hHeap=0x310000) returned 1 [0274.492] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0274.492] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0274.492] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.492] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0274.502] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0274.502] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0274.502] CloseHandle (hObject=0x4d4) returned 1 [0274.502] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0274.502] RmStartSession () returned 0x0 [0274.505] RmRegisterResources () returned 0x0 [0274.509] RmGetList () returned 0x0 [0275.426] RmShutdown () returned 0x0 [0276.524] RmEndSession () returned 0x0 [0276.525] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52611c8) returned 1 [0276.525] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0276.526] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF", dwFileAttributes=0x220) returned 1 [0276.526] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0276.526] CryptEncrypt (in: hKey=0x52611c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0276.526] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=20578) returned 1 [0276.526] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5281b40 [0276.527] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x58dc020 [0277.704] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0277.704] GetLastError () returned 0x0 [0277.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0277.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0277.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jHyoAmAcLevSikbwBL9Ul", cchWideChar=21, lpMultiByteStr=0x38c3b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jHyoAmAcLevSikbwBL9Ul", lpUsedDefaultChar=0x0) returned 21 [0277.704] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b650 | out: hHeap=0x310000) returned 1 [0277.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0277.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe70) returned 0x54e9bc0 [0277.704] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0277.704] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0277.705] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e9bc0*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e9bc0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe68, lpOverlapped=0x0) returned 1 [0277.706] CloseHandle (hObject=0x4d4) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e9bc0 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51be418 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3a00 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1ca8 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b34a8 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0277.706] CryptDestroyKey (hKey=0x52611c8) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5730 | out: hHeap=0x310000) returned 1 [0277.706] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2d20 | out: hHeap=0x310000) returned 1 [0277.706] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0277.706] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0277.706] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.707] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0277.724] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0277.724] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0277.724] CloseHandle (hObject=0x4d4) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0277.724] RmStartSession () returned 0x0 [0277.726] RmRegisterResources () returned 0x0 [0277.726] RmGetList () returned 0x0 [0277.751] RmShutdown () returned 0x0 [0280.936] RmEndSession () returned 0x0 [0280.937] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x35d7c8) returned 1 [0280.937] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0280.937] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF", dwFileAttributes=0x220) returned 1 [0280.938] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0280.938] CryptEncrypt (in: hKey=0x35d7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0280.938] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=9240) returned 1 [0280.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5cf0fd8 [0280.938] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x49e5020 [0281.760] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0281.760] ReadFile (in: hFile=0x4d4, lpBuffer=0x49e5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x49e5040*, lpNumberOfBytesRead=0x3f2f928*=0x2418, lpOverlapped=0x0) returned 1 [0281.762] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0281.762] CryptEncrypt (in: hKey=0x35d7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0281.762] WriteFile (in: hFile=0x4d4, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0281.762] CryptEncrypt (in: hKey=0x35d7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5cf0fe0*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5cf0fe0*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0281.762] WriteFile (in: hFile=0x4d4, lpBuffer=0x5cf0fe0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5cf0fe0*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0281.763] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0281.763] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0281.763] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0281.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x49e5020 | out: hHeap=0x310000) returned 1 [0283.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5cf0fd8 | out: hHeap=0x310000) returned 1 [0283.471] CloseHandle (hObject=0x4d4) returned 1 [0283.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0283.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0283.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a5270 [0283.471] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c0d90 [0283.471] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0283.471] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0283.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51a4ab8 [0283.472] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bdd30 [0283.472] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0283.472] GetLastError () returned 0x0 [0283.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0283.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1tVbp", cchWideChar=5, lpMultiByteStr=0x3f2f760, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1tVbp", lpUsedDefaultChar=0x0) returned 5 [0283.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e7eb0 [0283.473] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0283.473] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0283.473] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e7eb0*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e7eb0*, lpNumberOfBytesWritten=0x3f2f89c*=0xe58, lpOverlapped=0x0) returned 1 [0283.474] CloseHandle (hObject=0x4d4) returned 1 [0283.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0283.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e7eb0 | out: hHeap=0x310000) returned 1 [0283.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bdd30 | out: hHeap=0x310000) returned 1 [0283.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a4ab8 | out: hHeap=0x310000) returned 1 [0283.474] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x310000) returned 1 [0283.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51a5270 | out: hHeap=0x310000) returned 1 [0283.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0283.475] CryptDestroyKey (hKey=0x35d7c8) returned 1 [0283.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0283.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5f80 | out: hHeap=0x310000) returned 1 [0283.475] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e1f10 | out: hHeap=0x310000) returned 1 [0283.475] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0283.475] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0283.475] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.475] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0283.477] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0283.477] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0283.477] CloseHandle (hObject=0x4d4) returned 1 [0283.477] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b35d8 [0283.477] RmStartSession () returned 0x0 [0283.480] RmRegisterResources () returned 0x0 [0283.481] RmGetList () returned 0x0 [0283.900] RmShutdown () returned 0x0 [0285.261] RmEndSession () returned 0x0 [0285.299] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x52619c8) returned 1 [0285.299] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0285.299] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x220) returned 1 [0285.299] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0285.300] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0285.300] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=16676) returned 1 [0285.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6c6d010 [0285.300] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x6588020 [0285.319] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0285.319] ReadFile (in: hFile=0x4d4, lpBuffer=0x6588040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x6588040*, lpNumberOfBytesRead=0x3f2f928*=0x4124, lpOverlapped=0x0) returned 1 [0285.323] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0285.323] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0285.323] WriteFile (in: hFile=0x4d4, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0285.323] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0285.323] WriteFile (in: hFile=0x4d4, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0285.323] CryptEncrypt (in: hKey=0x52619c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6c6d020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0285.323] WriteFile (in: hFile=0x4d4, lpBuffer=0x6c6d020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6c6d020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0285.323] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0285.323] WriteFile (in: hFile=0x4d4, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0285.323] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0285.324] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6588020 | out: hHeap=0x310000) returned 1 [0285.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6c6d010 | out: hHeap=0x310000) returned 1 [0285.329] CloseHandle (hObject=0x4d4) returned 1 [0285.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0285.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1e18 [0285.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2b28 [0285.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c1d60 [0285.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1e18 | out: hHeap=0x310000) returned 1 [0285.329] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0285.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b2f50 [0285.330] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x51bd868 [0285.330] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0285.330] GetLastError () returned 0x0 [0285.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EeEKVCgmjwuQ", cchWideChar=12, lpMultiByteStr=0x3f2f760, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EeEKVCgmjwuQ", lpUsedDefaultChar=0x0) returned 12 [0285.331] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0285.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54e8d38 [0285.331] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x53552c8 [0285.331] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0285.332] WriteFile (in: hFile=0x4d4, lpBuffer=0x54e8d38*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54e8d38*, lpNumberOfBytesWritten=0x3f2f89c*=0xe5f, lpOverlapped=0x0) returned 1 [0285.332] CloseHandle (hObject=0x4d4) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53552c8 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54e8d38 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51bd868 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2f50 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c1d60 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b2b28 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0285.333] CryptDestroyKey (hKey=0x52619c8) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b35d8 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94c28 | out: hHeap=0x310000) returned 1 [0285.333] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2870 | out: hHeap=0x310000) returned 1 [0285.333] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0285.333] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0285.333] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.333] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0285.817] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.817] ReadFile (in: hFile=0x4d4, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0285.817] CloseHandle (hObject=0x4d4) returned 1 [0285.817] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x51b3bc8 [0285.817] RmStartSession () returned 0x0 [0285.818] RmRegisterResources () returned 0x0 [0285.922] RmGetList () returned 0x0 [0285.948] RmShutdown () returned 0x0 [0290.577] RmEndSession () returned 0x0 [0290.695] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x5261748) returned 1 [0290.695] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0290.695] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF", dwFileAttributes=0x220) returned 1 [0290.696] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.696] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0290.696] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=47996) returned 1 [0290.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x6752018 [0290.696] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4c29020 [0290.715] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0290.715] ReadFile (in: hFile=0x54c, lpBuffer=0x4c29040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x4c29040*, lpNumberOfBytesRead=0x3f2f928*=0xbb7c, lpOverlapped=0x0) returned 1 [0290.880] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0290.880] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.880] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.880] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.880] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.880] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.880] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.881] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.881] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.881] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.881] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.881] CryptEncrypt (in: hKey=0x5261748, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x6752020*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0290.881] WriteFile (in: hFile=0x54c, lpBuffer=0x6752020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x6752020*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0290.881] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0290.881] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0290.881] WriteFile (in: hFile=0x54c, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0290.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c29020 | out: hHeap=0x310000) returned 1 [0290.887] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x6752018 | out: hHeap=0x310000) returned 1 [0290.887] CloseHandle (hObject=0x54c) returned 1 [0290.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x36b198 [0290.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4aa8 [0290.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5730 [0290.887] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c4cd0 [0290.887] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4aa8 | out: hHeap=0x310000) returned 1 [0290.887] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0290.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a54d0 [0290.888] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0290.888] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0290.888] GetLastError () returned 0x0 [0290.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0290.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x3f2f760, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0290.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0290.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5157900 [0290.889] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.890] WriteFile (in: hFile=0x54c, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe54, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3f2f89c*=0xe54, lpOverlapped=0x0) returned 1 [0290.891] CloseHandle (hObject=0x54c) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5157900 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a54d0 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c4cd0 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5730 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x36b198 | out: hHeap=0x310000) returned 1 [0290.891] CryptDestroyKey (hKey=0x5261748) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51b3bc8 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c94df0 | out: hHeap=0x310000) returned 1 [0290.891] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e2780 | out: hHeap=0x310000) returned 1 [0290.891] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0290.891] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0290.891] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0290.891] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0291.191] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0291.191] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0291.191] CloseHandle (hObject=0x54c) returned 1 [0291.191] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a50a8 [0291.191] RmStartSession () returned 0x0 [0291.236] RmRegisterResources () returned 0x0 [0291.236] RmGetList () returned 0x0 [0291.365] RmShutdown () returned 0x0 [0293.140] RmEndSession () returned 0x0 [0293.221] CryptDuplicateKey (in: hKey=0x35e2c8, pdwReserved=0x0, dwFlags=0x0, phKey=0x3f2fa28 | out: phKey=0x3f2fa28*=0x35dc88) returned 1 [0293.221] GetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0293.221] SetFileAttributesW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF", dwFileAttributes=0x220) returned 1 [0293.221] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0293.221] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x3f2f888*=0x2000) returned 1 [0293.221] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3f2f920 | out: lpFileSize=0x3f2f920*=9304) returned 1 [0293.221] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x2033) returned 0x5af2070 [0293.221] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x100033) returned 0x4cf5020 [0293.240] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0293.240] ReadFile (in: hFile=0x54c, lpBuffer=0x4cf5040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x3f2f928, lpOverlapped=0x0 | out: lpBuffer=0x4cf5040*, lpNumberOfBytesRead=0x3f2f928*=0x2458, lpOverlapped=0x0) returned 1 [0293.310] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f910 | out: lpNewFilePointer=0x0) returned 1 [0293.310] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0293.310] WriteFile (in: hFile=0x54c, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0293.310] CryptEncrypt (in: hKey=0x35dc88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5af2080*, pdwDataLen=0x3f2f89c*=0x2000, dwBufLen=0x2000 | out: pbData=0x5af2080*, pdwDataLen=0x3f2f89c*=0x2000) returned 1 [0293.310] WriteFile (in: hFile=0x54c, lpBuffer=0x5af2080*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x5af2080*, lpNumberOfBytesWritten=0x3f2f92c*=0x2000, lpOverlapped=0x0) returned 1 [0293.310] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2f918 | out: lpNewFilePointer=0x0) returned 1 [0293.311] WriteFile (in: hFile=0x54c, lpBuffer=0x361238*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x361238*, lpNumberOfBytesWritten=0x3f2f92c*=0x200, lpOverlapped=0x0) returned 1 [0293.311] WriteFile (in: hFile=0x54c, lpBuffer=0x3f2f8c8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x3f2f8c8*, lpNumberOfBytesWritten=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0293.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4cf5020 | out: hHeap=0x310000) returned 1 [0293.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5af2070 | out: hHeap=0x310000) returned 1 [0293.316] CloseHandle (hObject=0x54c) returned 1 [0293.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0293.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5068 [0293.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a58f8 [0293.316] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3c5d58 [0293.316] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5068 | out: hHeap=0x310000) returned 1 [0293.316] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.bdCDdCBaAd" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.bdcddcbaad"), dwFlags=0x1) returned 1 [0293.317] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0293.317] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eb578 [0293.317] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0x3f2f6fc | out: lpSystemTimeAsFileTime=0x3f2f6fc) [0293.317] GetLastError () returned 0x0 [0293.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0293.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="574hfH", cchWideChar=6, lpMultiByteStr=0x3f2f760, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="574hfH", lpUsedDefaultChar=0x0) returned 6 [0293.318] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xe60) returned 0x54ee468 [0293.318] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x515cbb0 [0293.318] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SxgPNwKy_readme_.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sxgpnwky_readme_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0293.319] WriteFile (in: hFile=0x54c, lpBuffer=0x54ee468*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x3f2f89c, lpOverlapped=0x0 | out: lpBuffer=0x54ee468*, lpNumberOfBytesWritten=0x3f2f89c*=0xe59, lpOverlapped=0x0) returned 1 [0293.320] CloseHandle (hObject=0x54c) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x515cbb0 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54ee468 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eb578 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a5010 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3c5d58 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a58f8 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0293.320] CryptDestroyKey (hKey=0x35dc88) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a50a8 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x53070c8 | out: hHeap=0x310000) returned 1 [0293.320] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5609ea8 | out: hHeap=0x310000) returned 1 [0293.320] GetQueuedCompletionStatus (in: CompletionPort=0x23c, lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58, dwMilliseconds=0x3e8 | out: lpNumberOfBytesTransferred=0x3f2fa5c, lpCompletionKey=0x3f2fa60, lpOverlapped=0x3f2fa58) returned 1 [0293.320] CreateFileW (lpFileName="C:\\\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54c [0293.320] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f930 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.320] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f92c, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f92c*=0x18, lpOverlapped=0x0) returned 1 [0293.358] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0xffffffe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3f2f938 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.358] ReadFile (in: hFile=0x54c, lpBuffer=0x33de18, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x3f2f920, lpOverlapped=0x0 | out: lpBuffer=0x33de18*, lpNumberOfBytesRead=0x3f2f920*=0x18, lpOverlapped=0x0) returned 1 [0293.358] CloseHandle (hObject=0x54c) returned 1 [0293.358] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x3a5010 [0293.358] RmStartSession () returned 0x0 [0293.360] RmRegisterResources () returned 0x0 [0293.361] RmGetList () returned 0x0 [0295.644] RmShutdown () Thread: id = 151 os_tid = 0xbf8 Thread: id = 152 os_tid = 0xf88 Thread: id = 220 os_tid = 0xe08 Thread: id = 221 os_tid = 0xc90 Thread: id = 222 os_tid = 0xcd0 Thread: id = 223 os_tid = 0xa90 Thread: id = 224 os_tid = 0xa6c [0133.772] GetLastError () returned 0x57 [0133.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39df00 [0133.772] SetLastError (dwErrCode=0x57) [0133.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0133.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft\\Exchange Server\\*", lpFindFileData=0x4b1f6d8 | out: lpFindFileData=0x4b1f6d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0133.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0133.773] GetCurrentThreadId () returned 0xa6c [0133.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0133.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.773] GetLastError () returned 0x3 [0133.773] SetLastError (dwErrCode=0x3) [0133.773] FreeLibraryAndExitThread (hLibModule=0x250000, dwExitCode=0x0) [0133.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x396a10 | out: hHeap=0x310000) returned 1 [0133.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39df00 | out: hHeap=0x310000) returned 1 Thread: id = 225 os_tid = 0x10dc [0133.774] GetLastError () returned 0x57 [0133.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39df00 [0133.774] SetLastError (dwErrCode=0x57) [0133.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0133.774] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft\\Exchange Server\\*", lpFindFileData=0x4c5f904 | out: lpFindFileData=0x4c5f904*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0133.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0133.775] GetCurrentThreadId () returned 0x10dc [0133.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae00 | out: hHeap=0x310000) returned 1 [0133.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c1b0 | out: hHeap=0x310000) returned 1 [0133.775] GetLastError () returned 0x3 [0133.775] SetLastError (dwErrCode=0x3) [0133.775] FreeLibraryAndExitThread (hLibModule=0x250000, dwExitCode=0x0) [0133.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x396b30 | out: hHeap=0x310000) returned 1 [0133.775] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39df00 | out: hHeap=0x310000) returned 1 Thread: id = 226 os_tid = 0xe70 [0133.776] GetLastError () returned 0x57 [0133.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39df00 [0133.776] SetLastError (dwErrCode=0x57) [0133.776] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398e80 [0133.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\*", lpFindFileData=0x4d9fad8 | out: lpFindFileData=0x4d9fad8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0133.776] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398e80 | out: hHeap=0x310000) returned 1 [0133.777] GetCurrentThreadId () returned 0xe70 [0133.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399668 | out: hHeap=0x310000) returned 1 [0133.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.777] GetLastError () returned 0x3 [0133.777] SetLastError (dwErrCode=0x3) [0133.777] FreeLibraryAndExitThread (hLibModule=0x250000, dwExitCode=0x0) [0133.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3969b0 | out: hHeap=0x310000) returned 1 [0133.777] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39df00 | out: hHeap=0x310000) returned 1 Thread: id = 227 os_tid = 0x388 [0133.778] GetLastError () returned 0x57 [0133.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39df00 [0133.778] SetLastError (dwErrCode=0x57) [0133.778] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0133.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\*", lpFindFileData=0x4edf984 | out: lpFindFileData=0x4edf984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0133.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391768 | out: hHeap=0x310000) returned 1 [0133.778] GetCurrentThreadId () returned 0x388 [0133.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391e50 | out: hHeap=0x310000) returned 1 [0133.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bd88 | out: hHeap=0x310000) returned 1 [0133.778] GetLastError () returned 0x3 [0133.778] SetLastError (dwErrCode=0x3) [0133.778] FreeLibraryAndExitThread (hLibModule=0x250000, dwExitCode=0x0) [0133.778] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x396910 | out: hHeap=0x310000) returned 1 [0133.779] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39df00 | out: hHeap=0x310000) returned 1 Thread: id = 228 os_tid = 0x5a8 [0133.780] GetLastError () returned 0x57 [0133.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39df00 [0133.780] SetLastError (dwErrCode=0x57) [0133.780] FindFirstFileW (in: lpFileName="C:\\\\*", lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x35de08 [0133.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0133.780] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0133.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c278 [0133.780] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.780] FindFirstFileW (in: lpFileName="C:\\\\$GetCurrent\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d908 [0133.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.782] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.782] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0133.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.782] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.782] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bd50 [0133.782] FindFirstFileW (in: lpFileName="C:\\\\$GetCurrent\\Logs\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35dd48 [0133.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bd50 | out: hHeap=0x310000) returned 1 [0133.784] FindNextFileW (in: hFindFile=0x35dd48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.785] FindNextFileW (in: hFindFile=0x35dd48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0133.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0133.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364340 | out: hHeap=0x310000) returned 1 [0133.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.785] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365198 [0133.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.785] SetLastError (dwErrCode=0x57) [0133.785] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.786] SetLastError (dwErrCode=0x57) [0133.786] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.787] SetLastError (dwErrCode=0x57) [0133.787] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.788] SetLastError (dwErrCode=0x57) [0133.788] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.789] SetLastError (dwErrCode=0x57) [0133.789] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.790] SetLastError (dwErrCode=0x57) [0133.790] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.791] SetLastError (dwErrCode=0x57) [0133.791] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.792] GetLastError () returned 0x57 [0133.792] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.793] SetLastError (dwErrCode=0x57) [0133.793] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.794] SetLastError (dwErrCode=0x57) [0133.794] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.795] SetLastError (dwErrCode=0x57) [0133.795] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.796] GetLastError () returned 0x57 [0133.796] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.797] SetLastError (dwErrCode=0x57) [0133.797] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] GetLastError () returned 0x57 [0133.800] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.801] SetLastError (dwErrCode=0x57) [0133.801] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] GetLastError () returned 0x57 [0133.803] SetLastError (dwErrCode=0x57) [0133.803] GetLastError () returned 0x57 [0133.803] SetLastError (dwErrCode=0x57) [0133.803] GetLastError () returned 0x57 [0133.803] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0133.804] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=42674) returned 1 [0133.804] CloseHandle (hObject=0x48c) returned 1 [0133.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365368 [0133.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0133.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0133.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0133.805] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365368) returned 1 [0133.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365198 | out: hHeap=0x310000) returned 1 [0133.805] FindNextFileW (in: hFindFile=0x35dd48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0133.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bc00 [0133.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0133.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bc00 | out: hHeap=0x310000) returned 1 [0133.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0133.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c1b0 [0133.805] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae00 [0133.805] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c1b0 | out: hHeap=0x310000) returned 1 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.805] GetLastError () returned 0x0 [0133.805] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.806] SetLastError (dwErrCode=0x0) [0133.806] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.807] SetLastError (dwErrCode=0x0) [0133.807] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.808] GetLastError () returned 0x0 [0133.808] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.809] SetLastError (dwErrCode=0x0) [0133.809] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.810] GetLastError () returned 0x0 [0133.810] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.811] SetLastError (dwErrCode=0x0) [0133.811] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.812] SetLastError (dwErrCode=0x0) [0133.812] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.813] SetLastError (dwErrCode=0x0) [0133.813] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.814] GetLastError () returned 0x0 [0133.814] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.815] SetLastError (dwErrCode=0x0) [0133.815] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.816] GetLastError () returned 0x0 [0133.816] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.817] SetLastError (dwErrCode=0x0) [0133.817] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.818] SetLastError (dwErrCode=0x0) [0133.818] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.819] GetLastError () returned 0x0 [0133.819] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] SetLastError (dwErrCode=0x0) [0133.820] GetLastError () returned 0x0 [0133.820] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0133.906] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=6004) returned 1 [0133.906] CloseHandle (hObject=0x4b8) returned 1 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365408 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39aef0 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac20 [0133.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39aef0 | out: hHeap=0x310000) returned 1 [0133.906] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365408) returned 1 [0133.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae00 | out: hHeap=0x310000) returned 1 [0133.906] FindNextFileW (in: hFindFile=0x35dd48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0133.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.906] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b058 [0133.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.906] SetLastError (dwErrCode=0x0) [0133.906] GetLastError () returned 0x0 [0133.906] SetLastError (dwErrCode=0x0) [0133.906] GetLastError () returned 0x0 [0133.906] SetLastError (dwErrCode=0x0) [0133.906] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.909] GetLastError () returned 0x0 [0133.909] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.910] GetLastError () returned 0x0 [0133.910] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.911] SetLastError (dwErrCode=0x0) [0133.911] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.912] SetLastError (dwErrCode=0x0) [0133.912] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.913] SetLastError (dwErrCode=0x0) [0133.913] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.916] GetLastError () returned 0x0 [0133.916] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.917] GetLastError () returned 0x0 [0133.917] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.918] GetLastError () returned 0x0 [0133.918] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.919] GetLastError () returned 0x0 [0133.919] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.920] SetLastError (dwErrCode=0x0) [0133.920] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] SetLastError (dwErrCode=0x0) [0133.921] GetLastError () returned 0x0 [0133.921] CreateFileW (lpFileName="C:\\\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0133.922] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=40) returned 1 [0133.922] CloseHandle (hObject=0x4b8) returned 1 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365818 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b238 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac98 [0133.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b238 | out: hHeap=0x310000) returned 1 [0133.922] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365818) returned 1 [0133.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0133.922] FindNextFileW (in: hFindFile=0x35dd48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0133.922] FindClose (in: hFindFile=0x35dd48 | out: hFindFile=0x35dd48) returned 1 [0133.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.922] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c140 [0133.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398188 [0133.922] FindFirstFileW (in: lpFileName="C:\\\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35dcc8 [0133.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398188 | out: hHeap=0x310000) returned 1 [0133.925] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.925] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391cb0 [0133.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391cb0 | out: hHeap=0x310000) returned 1 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391838 [0133.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] GetLastError () returned 0x12 [0133.925] SetLastError (dwErrCode=0x12) [0133.925] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391838 | out: hHeap=0x310000) returned 1 [0133.925] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.925] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0133.926] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.926] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0133.926] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.926] SetLastError (dwErrCode=0x12) [0133.926] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.927] SetLastError (dwErrCode=0x12) [0133.927] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.928] SetLastError (dwErrCode=0x12) [0133.928] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.929] GetLastError () returned 0x12 [0133.929] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.930] GetLastError () returned 0x12 [0133.930] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.931] SetLastError (dwErrCode=0x12) [0133.931] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.932] SetLastError (dwErrCode=0x12) [0133.932] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.933] SetLastError (dwErrCode=0x12) [0133.933] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.934] GetLastError () returned 0x12 [0133.934] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.935] SetLastError (dwErrCode=0x12) [0133.935] GetLastError () returned 0x12 [0133.940] SetLastError (dwErrCode=0x12) [0133.940] GetLastError () returned 0x12 [0133.940] SetLastError (dwErrCode=0x12) [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365688 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391768 [0133.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0133.940] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365688) returned 1 [0133.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0133.940] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398f30 [0133.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398f30 | out: hHeap=0x310000) returned 1 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.940] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0133.940] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.940] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.941] SetLastError (dwErrCode=0x12) [0133.941] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.942] SetLastError (dwErrCode=0x12) [0133.942] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.943] SetLastError (dwErrCode=0x12) [0133.943] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.944] GetLastError () returned 0x12 [0133.944] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] GetLastError () returned 0x12 [0133.945] SetLastError (dwErrCode=0x12) [0133.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365bd8 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c70 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399350 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c70 | out: hHeap=0x310000) returned 1 [0133.946] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365bd8) returned 1 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0133.946] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365458 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3917d0 [0133.946] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391aa8 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3917d0 | out: hHeap=0x310000) returned 1 [0133.946] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365458) returned 1 [0133.946] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0133.946] FindNextFileW (in: hFindFile=0x35dcc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0133.946] FindClose (in: hFindFile=0x35dcc8 | out: hFindFile=0x35dcc8) returned 1 [0133.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c140 | out: hHeap=0x310000) returned 1 [0133.947] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0133.947] FindClose (in: hFindFile=0x35d908 | out: hFindFile=0x35d908) returned 1 [0133.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c278 | out: hHeap=0x310000) returned 1 [0133.947] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0133.947] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0133.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c70 [0133.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c70 | out: hHeap=0x310000) returned 1 [0133.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c18 [0133.948] CreateFileW (lpFileName="C:\\\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0134.193] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x501f6e0 | out: lpFileSize=0x501f6e0*=0) returned 1 [0134.193] CloseHandle (hObject=0x4e8) returned 1 [0134.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365a48 [0134.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0134.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d78 [0134.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0134.194] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365a48) returned 1 [0134.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c18 | out: hHeap=0x310000) returned 1 [0134.194] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0134.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0134.194] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0134.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb90 [0134.194] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x398068 [0134.194] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d9c8 [0134.196] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398068 | out: hHeap=0x310000) returned 1 [0134.196] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.750] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0134.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0134.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365868 [0134.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0134.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0134.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365868 [0134.751] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.751] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0134.751] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0134.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0134.753] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.753] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0134.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391560 [0134.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0134.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391560 | out: hHeap=0x310000) returned 1 [0134.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979a8 [0134.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3921f8 [0134.753] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979a8 | out: hHeap=0x310000) returned 1 [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.753] GetLastError () returned 0x0 [0134.753] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.754] SetLastError (dwErrCode=0x0) [0134.754] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.755] GetLastError () returned 0x0 [0134.755] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.756] GetLastError () returned 0x0 [0134.756] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.757] SetLastError (dwErrCode=0x0) [0134.757] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.758] GetLastError () returned 0x0 [0134.758] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.759] SetLastError (dwErrCode=0x0) [0134.759] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] GetLastError () returned 0x0 [0134.762] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.765] SetLastError (dwErrCode=0x0) [0134.765] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.766] SetLastError (dwErrCode=0x0) [0134.766] GetLastError () returned 0x0 [0134.767] SetLastError (dwErrCode=0x0) [0134.767] GetLastError () returned 0x0 [0134.767] SetLastError (dwErrCode=0x0) [0134.767] GetLastError () returned 0x0 [0134.767] SetLastError (dwErrCode=0x0) [0134.767] GetLastError () returned 0x0 [0134.767] SetLastError (dwErrCode=0x0) [0134.767] GetLastError () returned 0x0 [0134.767] SetLastError (dwErrCode=0x0) [0134.767] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] GetLastError () returned 0x0 [0134.768] SetLastError (dwErrCode=0x0) [0134.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3655e8 [0134.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399458 [0134.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3990e8 [0134.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399458 | out: hHeap=0x310000) returned 1 [0134.768] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3655e8) returned 1 [0134.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0134.768] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0134.768] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391eb8 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3658b8 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b10 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3918a0 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0134.769] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3658b8) returned 1 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391eb8 | out: hHeap=0x310000) returned 1 [0134.769] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397498 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397498 | out: hHeap=0x310000) returned 1 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979a8 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979a8 | out: hHeap=0x310000) returned 1 [0134.769] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.769] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0134.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365868 | out: hHeap=0x310000) returned 1 [0134.769] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0134.769] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365908 [0134.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365908 | out: hHeap=0x310000) returned 1 [0134.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3659f8 [0134.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.770] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0134.770] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261308 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0134.772] FindNextFileW (in: hFindFile=0x5261308, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.772] FindNextFileW (in: hFindFile=0x5261308, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3919d8 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3919d8 | out: hHeap=0x310000) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391908 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365a98 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398fe0 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399140 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398fe0 | out: hHeap=0x310000) returned 1 [0134.772] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365a98) returned 1 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.772] FindNextFileW (in: hFindFile=0x5261308, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3919d8 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3919d8 | out: hHeap=0x310000) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0134.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365c28 [0134.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391cb0 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.773] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365c28) returned 1 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391d80 | out: hHeap=0x310000) returned 1 [0134.773] FindNextFileW (in: hFindFile=0x5261308, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b10 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0134.773] FindNextFileW (in: hFindFile=0x5261308, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.773] FindClose (in: hFindFile=0x5261308 | out: hFindFile=0x5261308) returned 1 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3659f8 | out: hHeap=0x310000) returned 1 [0134.773] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3656d8 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3656d8 | out: hHeap=0x310000) returned 1 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c370 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3652c8 [0134.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c370 | out: hHeap=0x310000) returned 1 [0134.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0134.773] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260d48 [0134.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0134.951] FindNextFileW (in: hFindFile=0x5260d48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.951] FindNextFileW (in: hFindFile=0x5260d48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3919d8 [0134.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0134.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3919d8 | out: hHeap=0x310000) returned 1 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391700 [0134.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365868 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0134.951] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398fe0 [0134.951] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0134.952] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365868) returned 1 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0134.952] FindNextFileW (in: hFindFile=0x5260d48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3975b8 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392058 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3975b8 | out: hHeap=0x310000) returned 1 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392058 | out: hHeap=0x310000) returned 1 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391c48 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365ae8 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b10 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d80 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0134.952] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365ae8) returned 1 [0134.952] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391c48 | out: hHeap=0x310000) returned 1 [0134.952] FindNextFileW (in: hFindFile=0x5260d48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0134.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3919d8 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3919d8 | out: hHeap=0x310000) returned 1 [0134.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397cc0 [0134.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397cc0 | out: hHeap=0x310000) returned 1 [0134.953] FindNextFileW (in: hFindFile=0x5260d48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.953] FindClose (in: hFindFile=0x5260d48 | out: hFindFile=0x5260d48) returned 1 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3652c8 | out: hHeap=0x310000) returned 1 [0134.953] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0134.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0134.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3656d8 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0134.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3656d8 | out: hHeap=0x310000) returned 1 [0134.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0134.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3656d8 [0134.954] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0134.954] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0134.954] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0134.956] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.956] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397528 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391b10 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391b10 | out: hHeap=0x310000) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391908 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3659f8 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3995b8 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399458 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3995b8 | out: hHeap=0x310000) returned 1 [0134.956] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3659f8) returned 1 [0134.956] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.956] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0134.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365b88 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b10 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.957] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365b88) returned 1 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0134.957] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391f20 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0134.957] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0134.957] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0134.957] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.958] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0134.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3656d8 | out: hHeap=0x310000) returned 1 [0134.958] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3652c8 [0134.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3652c8 | out: hHeap=0x310000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x3652c8 [0134.958] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0134.958] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0134.959] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0134.959] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.959] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391908 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3919d8 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3656d8 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3993a8 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0134.960] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3656d8) returned 1 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3919d8 | out: hHeap=0x310000) returned 1 [0134.960] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391ff0 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397720 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0134.960] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397720 | out: hHeap=0x310000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365778 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392128 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391908 | out: hHeap=0x310000) returned 1 [0134.961] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365778) returned 1 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0134.961] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391908 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0134.961] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.961] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0134.961] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3652c8 | out: hHeap=0x310000) returned 1 [0134.961] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0134.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0134.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365908 [0134.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0134.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365908 | out: hHeap=0x310000) returned 1 [0134.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c290 [0134.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x365908 [0134.962] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c290 | out: hHeap=0x310000) returned 1 [0134.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3976d8 [0134.962] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0135.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3976d8 | out: hHeap=0x310000) returned 1 [0135.274] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.274] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397960 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391970 [0135.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0135.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397720 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391560 [0135.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397720 | out: hHeap=0x310000) returned 1 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18de0 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399038 [0135.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0135.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399038 | out: hHeap=0x310000) returned 1 [0135.275] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18de0) returned 1 [0135.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391560 | out: hHeap=0x310000) returned 1 [0135.275] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391ff0 [0135.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0135.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391560 [0135.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18b60 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392058 [0135.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.277] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18b60) returned 1 [0135.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391560 | out: hHeap=0x310000) returned 1 [0135.277] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0135.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c78 [0135.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d18 [0135.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c78 | out: hHeap=0x310000) returned 1 [0135.278] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.278] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0135.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365908 | out: hHeap=0x310000) returned 1 [0135.278] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0135.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19330 [0135.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19330 | out: hHeap=0x310000) returned 1 [0135.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0135.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18e30 [0135.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0135.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397498 [0135.278] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0135.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397498 | out: hHeap=0x310000) returned 1 [0135.279] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.279] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397840 [0135.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391970 [0135.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0135.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c30 [0135.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391be0 [0135.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0135.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18bb0 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399248 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399248 | out: hHeap=0x310000) returned 1 [0135.280] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18bb0) returned 1 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.280] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18e80 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391c48 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.280] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18e80) returned 1 [0135.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.280] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.281] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.281] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e30 | out: hHeap=0x310000) returned 1 [0135.281] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c3e0 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19240 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c3e0 | out: hHeap=0x310000) returned 1 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19240 | out: hHeap=0x310000) returned 1 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19150 [0135.281] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.281] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b10 [0135.281] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52612c8 [0135.282] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0135.282] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.282] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397498 [0135.282] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3920c0 [0135.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397498 | out: hHeap=0x310000) returned 1 [0135.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0135.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0135.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391700 [0135.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0135.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19380 [0135.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3995b8 [0135.283] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399248 [0135.283] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3995b8 | out: hHeap=0x310000) returned 1 [0135.283] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19380) returned 1 [0135.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.284] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0135.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0135.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0135.284] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391560 [0135.284] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.284] SetLastError (dwErrCode=0x12) [0135.284] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.285] SetLastError (dwErrCode=0x12) [0135.285] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.286] GetLastError () returned 0x12 [0135.286] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.287] GetLastError () returned 0x12 [0135.287] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.288] GetLastError () returned 0x12 [0135.288] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.289] SetLastError (dwErrCode=0x12) [0135.289] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.290] SetLastError (dwErrCode=0x12) [0135.290] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] GetLastError () returned 0x12 [0135.291] SetLastError (dwErrCode=0x12) [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18f20 [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391b78 [0135.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0135.291] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18f20) returned 1 [0135.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391560 | out: hHeap=0x310000) returned 1 [0135.291] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0135.291] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397600 [0135.292] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397600 | out: hHeap=0x310000) returned 1 [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] GetLastError () returned 0x12 [0135.292] SetLastError (dwErrCode=0x12) [0135.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.292] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.292] FindClose (in: hFindFile=0x52612c8 | out: hFindFile=0x52612c8) returned 1 [0135.292] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19150 | out: hHeap=0x310000) returned 1 [0135.292] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0135.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18d40 [0135.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0135.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18d40 | out: hHeap=0x310000) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0135.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18e30 [0135.293] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0135.293] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52612c8 [0135.294] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0135.294] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.294] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0135.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x392190 [0135.294] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0135.294] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0135.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0135.294] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x392190 [0135.294] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0135.294] GetLastError () returned 0x12 [0135.294] SetLastError (dwErrCode=0x12) [0135.294] GetLastError () returned 0x12 [0135.294] SetLastError (dwErrCode=0x12) [0135.294] GetLastError () returned 0x12 [0135.294] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.295] SetLastError (dwErrCode=0x12) [0135.295] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.296] SetLastError (dwErrCode=0x12) [0135.296] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.297] GetLastError () returned 0x12 [0135.297] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.298] SetLastError (dwErrCode=0x12) [0135.298] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.299] SetLastError (dwErrCode=0x12) [0135.299] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.300] SetLastError (dwErrCode=0x12) [0135.300] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.301] SetLastError (dwErrCode=0x12) [0135.301] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.302] SetLastError (dwErrCode=0x12) [0135.302] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.303] SetLastError (dwErrCode=0x12) [0135.303] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] GetLastError () returned 0x12 [0135.304] SetLastError (dwErrCode=0x12) [0135.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c190b0 [0135.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3994b0 [0135.304] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399508 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3994b0 | out: hHeap=0x310000) returned 1 [0135.305] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c190b0) returned 1 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0135.305] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391ff0 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391ff0 | out: hHeap=0x310000) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18c50 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391ff0 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.305] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18c50) returned 1 [0135.305] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x392190 | out: hHeap=0x310000) returned 1 [0135.305] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397690 [0135.305] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397690 | out: hHeap=0x310000) returned 1 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0135.306] FindNextFileW (in: hFindFile=0x52612c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.306] FindClose (in: hFindFile=0x52612c8 | out: hFindFile=0x52612c8) returned 1 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18e30 | out: hHeap=0x310000) returned 1 [0135.306] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19060 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19060 | out: hHeap=0x310000) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c192e0 [0135.306] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0135.306] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0135.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0135.307] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.307] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0135.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391700 [0135.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.307] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979a8 [0135.307] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391eb8 [0135.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979a8 | out: hHeap=0x310000) returned 1 [0135.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19150 [0135.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c18 [0135.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3994b0 [0135.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398c18 | out: hHeap=0x310000) returned 1 [0135.309] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19150) returned 1 [0135.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391eb8 | out: hHeap=0x310000) returned 1 [0135.309] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3976d8 [0135.309] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3976d8 | out: hHeap=0x310000) returned 1 [0135.309] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18e30 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391d18 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.310] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18e30) returned 1 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391970 | out: hHeap=0x310000) returned 1 [0135.310] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a80 [0135.310] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.310] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a80 | out: hHeap=0x310000) returned 1 [0135.310] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.310] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0135.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c192e0 | out: hHeap=0x310000) returned 1 [0135.311] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0135.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18c00 [0135.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c00 | out: hHeap=0x310000) returned 1 [0135.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c18c00 [0135.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.311] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397408 [0135.311] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0135.311] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397408 | out: hHeap=0x310000) returned 1 [0135.312] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.312] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3974e0 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391f20 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3974e0 | out: hHeap=0x310000) returned 1 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391f20 | out: hHeap=0x310000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391eb8 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19100 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3995b8 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398c18 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3995b8 | out: hHeap=0x310000) returned 1 [0135.312] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19100) returned 1 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391eb8 | out: hHeap=0x310000) returned 1 [0135.312] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0135.312] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.312] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397450 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397450 | out: hHeap=0x310000) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18f70 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391970 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.313] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18f70) returned 1 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0135.313] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ba0 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391eb8 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ba0 | out: hHeap=0x310000) returned 1 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391eb8 | out: hHeap=0x310000) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0135.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0135.313] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.313] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0135.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18c00 | out: hHeap=0x310000) returned 1 [0135.314] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c191a0 [0135.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c191a0 | out: hHeap=0x310000) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19060 [0135.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3978d0 [0135.314] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3978d0 | out: hHeap=0x310000) returned 1 [0135.610] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.610] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397be8 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x3920c0 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397be8 | out: hHeap=0x310000) returned 1 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3920c0 | out: hHeap=0x310000) returned 1 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391be0 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19290 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399770 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a30 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399770 | out: hHeap=0x310000) returned 1 [0135.610] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19290) returned 1 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.610] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c78 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c78 | out: hHeap=0x310000) returned 1 [0135.610] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391be0 | out: hHeap=0x310000) returned 1 [0135.610] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18ed0 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391be0 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.611] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18ed0) returned 1 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.611] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3979f0 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3979f0 | out: hHeap=0x310000) returned 1 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397918 [0135.611] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x392190 [0135.611] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0135.611] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.611] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0135.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19060 | out: hHeap=0x310000) returned 1 [0135.612] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0135.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0135.612] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c192e0 [0135.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0135.612] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c192e0 | out: hHeap=0x310000) returned 1 [0135.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19240 [0135.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0135.613] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977f8 [0135.613] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0135.613] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0135.613] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.614] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397888 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391de8 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397ac8 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x5e) returned 0x391de8 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18d90 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399928 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399a88 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399928 | out: hHeap=0x310000) returned 1 [0135.614] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18d90) returned 1 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.614] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397570 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397570 | out: hHeap=0x310000) returned 1 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397c78 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391700 [0135.614] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c78 | out: hHeap=0x310000) returned 1 [0135.614] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18fc0 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3921f8 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x3920c0 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3921f8 | out: hHeap=0x310000) returned 1 [0135.615] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18fc0) returned 1 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391700 | out: hHeap=0x310000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397b58 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391de8 | out: hHeap=0x310000) returned 1 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x3977b0 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x391de8 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.615] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0135.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19240 | out: hHeap=0x310000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0135.615] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0135.615] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0135.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397528 | out: hHeap=0x310000) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.616] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0135.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19010 | out: hHeap=0x310000) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0135.616] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260dc8 [0135.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397c30 | out: hHeap=0x310000) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x5260dc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x5260dc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x5260dc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x5260dc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x5260dc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.617] FindClose (in: hFindFile=0x5260dc8 | out: hFindFile=0x5260dc8) returned 1 [0135.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19010 | out: hHeap=0x310000) returned 1 [0135.617] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0135.617] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0135.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397960 | out: hHeap=0x310000) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.618] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0135.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19330 | out: hHeap=0x310000) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0135.618] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261288 [0135.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397840 | out: hHeap=0x310000) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.620] FindClose (in: hFindFile=0x5261288 | out: hFindFile=0x5261288) returned 1 [0135.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19010 | out: hHeap=0x310000) returned 1 [0135.620] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0135.620] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0135.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397498 | out: hHeap=0x310000) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.621] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0135.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18cf0 | out: hHeap=0x310000) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0135.621] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0135.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397a38 | out: hHeap=0x310000) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.621] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0135.622] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0135.622] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0135.622] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0135.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0135.622] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0135.622] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0135.623] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977b0 | out: hHeap=0x310000) returned 1 [0135.623] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.623] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0135.623] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.003] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.004] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.004] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0136.004] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.004] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0136.004] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52610c8 [0136.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3977f8 | out: hHeap=0x310000) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x52610c8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.005] FindClose (in: hFindFile=0x52610c8 | out: hFindFile=0x52610c8) returned 1 [0136.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0136.005] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261208 [0136.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397ac8 | out: hHeap=0x310000) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.005] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.006] FindClose (in: hFindFile=0x5261208 | out: hFindFile=0x5261208) returned 1 [0136.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0136.006] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261208 [0136.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397918 | out: hHeap=0x310000) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.006] FindClose (in: hFindFile=0x5261208 | out: hFindFile=0x5261208) returned 1 [0136.006] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.006] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0136.006] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0136.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397888 | out: hHeap=0x310000) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.007] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0136.007] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.007] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0136.007] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0136.008] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b10 | out: hHeap=0x310000) returned 1 [0136.008] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.008] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.008] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.008] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.008] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.008] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0136.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.012] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0136.012] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260bc8 [0136.013] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397b58 | out: hHeap=0x310000) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x5260bc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x5260bc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x5260bc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x5260bc8, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0136.013] FindClose (in: hFindFile=0x5260bc8 | out: hFindFile=0x5260bc8) returned 1 [0136.013] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c18a20 | out: hHeap=0x310000) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0136.013] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0136.013] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0136.014] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=88533) returned 1 [0136.014] CloseHandle (hObject=0x5bc) returned 1 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5418 | out: hHeap=0x310000) returned 1 [0136.014] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19600) returned 1 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0136.014] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19650 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19650 | out: hHeap=0x310000) returned 1 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19650 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0136.014] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261208 [0136.014] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0136.015] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.015] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0136.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394cf8 [0136.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0136.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394cf8 | out: hHeap=0x310000) returned 1 [0136.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0136.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x393ef8 [0136.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.015] GetLastError () returned 0x0 [0136.015] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.016] SetLastError (dwErrCode=0x0) [0136.016] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.017] GetLastError () returned 0x0 [0136.017] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.018] SetLastError (dwErrCode=0x0) [0136.018] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.019] SetLastError (dwErrCode=0x0) [0136.019] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] GetLastError () returned 0x0 [0136.020] SetLastError (dwErrCode=0x0) [0136.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c196a0 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b058 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39aef0 [0136.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0136.021] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c196a0) returned 1 [0136.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x393ef8 | out: hHeap=0x310000) returned 1 [0136.021] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394bf8 [0136.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0136.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394bf8 | out: hHeap=0x310000) returned 1 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0136.021] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3948f8 [0136.021] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.021] SetLastError (dwErrCode=0x0) [0136.021] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.022] GetLastError () returned 0x0 [0136.022] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.023] SetLastError (dwErrCode=0x0) [0136.023] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.024] GetLastError () returned 0x0 [0136.024] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.025] SetLastError (dwErrCode=0x0) [0136.025] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.026] GetLastError () returned 0x0 [0136.026] SetLastError (dwErrCode=0x0) [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19740 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50605c8 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060080 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50605c8 | out: hHeap=0x310000) returned 1 [0136.027] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19740) returned 1 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3948f8 | out: hHeap=0x310000) returned 1 [0136.027] FindNextFileW (in: hFindFile=0x5261208, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0136.027] FindClose (in: hFindFile=0x5261208 | out: hFindFile=0x5261208) returned 1 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19650 | out: hHeap=0x310000) returned 1 [0136.027] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19650 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19650 | out: hHeap=0x310000) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x46) returned 0x4c19650 [0136.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0136.027] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0136.027] FindFirstFileW (in: lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260c88 [0136.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0136.534] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.534] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0136.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5260 [0136.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394078 [0136.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5260 | out: hHeap=0x310000) returned 1 [0136.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394078 | out: hHeap=0x310000) returned 1 [0136.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0136.534] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3946f8 [0136.534] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0136.534] GetLastError () returned 0x12 [0136.534] SetLastError (dwErrCode=0x12) [0136.534] GetLastError () returned 0x12 [0136.534] SetLastError (dwErrCode=0x12) [0136.534] GetLastError () returned 0x12 [0136.534] SetLastError (dwErrCode=0x12) [0136.534] GetLastError () returned 0x12 [0136.534] SetLastError (dwErrCode=0x12) [0136.534] GetLastError () returned 0x12 [0136.534] SetLastError (dwErrCode=0x12) [0136.534] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.535] GetLastError () returned 0x12 [0136.535] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.536] SetLastError (dwErrCode=0x12) [0136.536] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.537] SetLastError (dwErrCode=0x12) [0136.537] GetLastError () returned 0x12 [0136.538] SetLastError (dwErrCode=0x12) [0136.538] GetLastError () returned 0x12 [0136.538] SetLastError (dwErrCode=0x12) [0136.538] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0136.539] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=1150) returned 1 [0136.539] CloseHandle (hObject=0x5b0) returned 1 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3652c8 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060560 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060970 [0136.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060560 | out: hHeap=0x310000) returned 1 [0136.539] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3652c8) returned 1 [0136.539] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3946f8 | out: hHeap=0x310000) returned 1 [0136.539] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0136.539] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x393ff8 [0136.540] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0136.540] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x393ff8 | out: hHeap=0x310000) returned 1 [0136.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0136.540] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3948f8 [0136.540] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.540] SetLastError (dwErrCode=0x0) [0136.540] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.541] SetLastError (dwErrCode=0x0) [0136.541] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.542] SetLastError (dwErrCode=0x0) [0136.542] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.543] GetLastError () returned 0x0 [0136.543] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.544] SetLastError (dwErrCode=0x0) [0136.544] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.545] SetLastError (dwErrCode=0x0) [0136.545] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.546] SetLastError (dwErrCode=0x0) [0136.546] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.547] SetLastError (dwErrCode=0x0) [0136.547] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.548] SetLastError (dwErrCode=0x0) [0136.548] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.549] GetLastError () returned 0x0 [0136.549] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.550] SetLastError (dwErrCode=0x0) [0136.550] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.551] GetLastError () returned 0x0 [0136.551] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.552] GetLastError () returned 0x0 [0136.552] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.553] SetLastError (dwErrCode=0x0) [0136.553] GetLastError () returned 0x0 [0136.554] SetLastError (dwErrCode=0x0) [0136.554] GetLastError () returned 0x0 [0136.554] SetLastError (dwErrCode=0x0) [0136.554] GetLastError () returned 0x0 [0136.554] SetLastError (dwErrCode=0x0) [0136.554] GetLastError () returned 0x0 [0136.554] SetLastError (dwErrCode=0x0) [0136.554] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0136.554] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0136.554] CloseHandle (hObject=0x5b0) returned 1 [0136.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365908 [0136.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50600e8 [0136.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060aa8 [0136.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50600e8 | out: hHeap=0x310000) returned 1 [0136.554] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365908) returned 1 [0136.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3948f8 | out: hHeap=0x310000) returned 1 [0136.555] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0136.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0136.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394c78 [0136.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0136.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394c78 | out: hHeap=0x310000) returned 1 [0136.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5158 [0136.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394078 [0136.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5158 | out: hHeap=0x310000) returned 1 [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.555] GetLastError () returned 0x0 [0136.555] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.556] GetLastError () returned 0x0 [0136.556] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.557] SetLastError (dwErrCode=0x0) [0136.557] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.558] SetLastError (dwErrCode=0x0) [0136.558] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.559] SetLastError (dwErrCode=0x0) [0136.559] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.560] SetLastError (dwErrCode=0x0) [0136.560] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.561] GetLastError () returned 0x0 [0136.561] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.562] GetLastError () returned 0x0 [0136.562] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.563] GetLastError () returned 0x0 [0136.563] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.564] GetLastError () returned 0x0 [0136.564] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.565] SetLastError (dwErrCode=0x0) [0136.565] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.566] GetLastError () returned 0x0 [0136.566] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.567] SetLastError (dwErrCode=0x0) [0136.567] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.568] GetLastError () returned 0x0 [0136.568] SetLastError (dwErrCode=0x0) [0136.569] GetLastError () returned 0x0 [0136.569] SetLastError (dwErrCode=0x0) [0136.569] GetLastError () returned 0x0 [0136.569] SetLastError (dwErrCode=0x0) [0136.569] GetLastError () returned 0x0 [0136.569] SetLastError (dwErrCode=0x0) [0136.569] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0136.569] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0136.569] CloseHandle (hObject=0x5b0) returned 1 [0136.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3271a0 [0136.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060428 [0136.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50601b8 [0136.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060428 | out: hHeap=0x310000) returned 1 [0136.569] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3271a0) returned 1 [0136.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394078 | out: hHeap=0x310000) returned 1 [0136.569] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0136.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e56d8 [0136.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x393ef8 [0136.569] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e56d8 | out: hHeap=0x310000) returned 1 [0136.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x393ef8 | out: hHeap=0x310000) returned 1 [0136.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e54c8 [0136.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394a78 [0136.570] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e54c8 | out: hHeap=0x310000) returned 1 [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.570] SetLastError (dwErrCode=0x0) [0136.570] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.571] SetLastError (dwErrCode=0x0) [0136.571] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.572] SetLastError (dwErrCode=0x0) [0136.572] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.573] SetLastError (dwErrCode=0x0) [0136.573] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.574] GetLastError () returned 0x0 [0136.574] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.575] SetLastError (dwErrCode=0x0) [0136.575] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.576] GetLastError () returned 0x0 [0136.576] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.577] SetLastError (dwErrCode=0x0) [0136.577] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.578] GetLastError () returned 0x0 [0136.578] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.579] SetLastError (dwErrCode=0x0) [0136.579] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.580] SetLastError (dwErrCode=0x0) [0136.580] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.768] GetLastError () returned 0x0 [0136.768] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.769] GetLastError () returned 0x0 [0136.769] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.770] SetLastError (dwErrCode=0x0) [0136.770] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] GetLastError () returned 0x0 [0136.771] SetLastError (dwErrCode=0x0) [0136.771] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0136.771] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0136.771] CloseHandle (hObject=0x5d8) returned 1 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19790 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060700 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060220 [0136.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060700 | out: hHeap=0x310000) returned 1 [0136.772] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19790) returned 1 [0136.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394a78 | out: hHeap=0x310000) returned 1 [0136.772] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5158 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3944f8 [0136.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5158 | out: hHeap=0x310000) returned 1 [0136.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3944f8 | out: hHeap=0x310000) returned 1 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0136.772] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394c78 [0136.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.772] SetLastError (dwErrCode=0x0) [0136.772] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.773] SetLastError (dwErrCode=0x0) [0136.773] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.774] SetLastError (dwErrCode=0x0) [0136.774] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.775] GetLastError () returned 0x0 [0136.775] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.776] SetLastError (dwErrCode=0x0) [0136.776] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.777] SetLastError (dwErrCode=0x0) [0136.777] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.778] GetLastError () returned 0x0 [0136.778] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.779] SetLastError (dwErrCode=0x0) [0136.779] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.780] SetLastError (dwErrCode=0x0) [0136.780] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.781] SetLastError (dwErrCode=0x0) [0136.781] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.782] GetLastError () returned 0x0 [0136.782] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.783] GetLastError () returned 0x0 [0136.783] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.784] SetLastError (dwErrCode=0x0) [0136.784] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.785] SetLastError (dwErrCode=0x0) [0136.785] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.786] GetLastError () returned 0x0 [0136.786] SetLastError (dwErrCode=0x0) [0136.787] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0136.787] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0136.788] CloseHandle (hObject=0x5d8) returned 1 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5e90 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060150 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50602f0 [0136.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060150 | out: hHeap=0x310000) returned 1 [0136.788] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5e90) returned 1 [0136.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394c78 | out: hHeap=0x310000) returned 1 [0136.788] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394178 [0136.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0136.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394178 | out: hHeap=0x310000) returned 1 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0136.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3948f8 [0136.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0136.788] GetLastError () returned 0x0 [0136.788] SetLastError (dwErrCode=0x0) [0136.788] GetLastError () returned 0x0 [0136.788] SetLastError (dwErrCode=0x0) [0136.788] GetLastError () returned 0x0 [0136.788] SetLastError (dwErrCode=0x0) [0136.788] GetLastError () returned 0x0 [0136.788] SetLastError (dwErrCode=0x0) [0136.788] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.789] SetLastError (dwErrCode=0x0) [0136.789] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.790] GetLastError () returned 0x0 [0136.790] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.791] SetLastError (dwErrCode=0x0) [0136.791] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.792] GetLastError () returned 0x0 [0136.792] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.793] SetLastError (dwErrCode=0x0) [0136.793] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.794] GetLastError () returned 0x0 [0136.794] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.795] SetLastError (dwErrCode=0x0) [0136.795] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.796] GetLastError () returned 0x0 [0136.796] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.797] GetLastError () returned 0x0 [0136.797] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.798] GetLastError () returned 0x0 [0136.798] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.799] SetLastError (dwErrCode=0x0) [0136.799] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.800] GetLastError () returned 0x0 [0136.800] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.801] GetLastError () returned 0x0 [0136.801] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.802] GetLastError () returned 0x0 [0136.802] SetLastError (dwErrCode=0x0) [0136.803] GetLastError () returned 0x0 [0136.803] SetLastError (dwErrCode=0x0) [0136.803] GetLastError () returned 0x0 [0136.803] SetLastError (dwErrCode=0x0) [0136.803] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0136.803] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0136.803] CloseHandle (hObject=0x5d8) returned 1 [0136.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5800 [0136.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060768 [0136.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060b10 [0136.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060768 | out: hHeap=0x310000) returned 1 [0136.803] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5800) returned 1 [0136.803] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3948f8 | out: hHeap=0x310000) returned 1 [0136.803] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0136.803] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0136.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3946f8 [0136.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0136.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3946f8 | out: hHeap=0x310000) returned 1 [0136.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5208 [0136.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394078 [0136.804] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5208 | out: hHeap=0x310000) returned 1 [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.804] SetLastError (dwErrCode=0x0) [0136.804] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.805] SetLastError (dwErrCode=0x0) [0136.805] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.806] SetLastError (dwErrCode=0x0) [0136.806] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.807] SetLastError (dwErrCode=0x0) [0136.807] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.808] GetLastError () returned 0x0 [0136.808] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.809] GetLastError () returned 0x0 [0136.809] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.810] GetLastError () returned 0x0 [0136.810] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.811] GetLastError () returned 0x0 [0136.811] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.812] GetLastError () returned 0x0 [0136.812] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.813] SetLastError (dwErrCode=0x0) [0136.813] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0136.814] GetLastError () returned 0x0 [0136.814] SetLastError (dwErrCode=0x0) [0137.172] GetLastError () returned 0x0 [0137.172] SetLastError (dwErrCode=0x0) [0137.172] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.232] GetLastError () returned 0x0 [0137.232] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.233] SetLastError (dwErrCode=0x0) [0137.233] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.234] SetLastError (dwErrCode=0x0) [0137.234] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.235] SetLastError (dwErrCode=0x0) [0137.235] GetLastError () returned 0x0 [0137.236] SetLastError (dwErrCode=0x0) [0137.236] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0137.236] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0137.236] CloseHandle (hObject=0x618) returned 1 [0137.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5da0 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060768 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060560 [0137.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060768 | out: hHeap=0x310000) returned 1 [0137.237] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5da0) returned 1 [0137.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394078 | out: hHeap=0x310000) returned 1 [0137.237] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x393ff8 [0137.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0137.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x393ff8 | out: hHeap=0x310000) returned 1 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0137.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3944f8 [0137.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.237] GetLastError () returned 0x0 [0137.237] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.238] SetLastError (dwErrCode=0x0) [0137.238] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.239] SetLastError (dwErrCode=0x0) [0137.239] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.240] GetLastError () returned 0x0 [0137.240] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.241] SetLastError (dwErrCode=0x0) [0137.241] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.242] GetLastError () returned 0x0 [0137.242] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.243] SetLastError (dwErrCode=0x0) [0137.243] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.244] GetLastError () returned 0x0 [0137.244] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.245] SetLastError (dwErrCode=0x0) [0137.245] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.246] SetLastError (dwErrCode=0x0) [0137.246] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.247] GetLastError () returned 0x0 [0137.247] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.248] GetLastError () returned 0x0 [0137.248] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.249] SetLastError (dwErrCode=0x0) [0137.249] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.250] SetLastError (dwErrCode=0x0) [0137.250] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.251] GetLastError () returned 0x0 [0137.251] SetLastError (dwErrCode=0x0) [0137.252] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0137.252] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0137.252] CloseHandle (hObject=0x618) returned 1 [0137.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5d50 [0137.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060428 [0137.252] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060be0 [0137.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060428 | out: hHeap=0x310000) returned 1 [0137.253] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5d50) returned 1 [0137.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3944f8 | out: hHeap=0x310000) returned 1 [0137.253] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0137.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5418 [0137.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394678 [0137.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5418 | out: hHeap=0x310000) returned 1 [0137.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394678 | out: hHeap=0x310000) returned 1 [0137.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0137.253] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394a78 [0137.253] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.253] SetLastError (dwErrCode=0x0) [0137.253] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.254] GetLastError () returned 0x0 [0137.254] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.255] GetLastError () returned 0x0 [0137.255] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.256] SetLastError (dwErrCode=0x0) [0137.256] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.257] GetLastError () returned 0x0 [0137.257] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.258] SetLastError (dwErrCode=0x0) [0137.258] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.259] GetLastError () returned 0x0 [0137.259] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.260] GetLastError () returned 0x0 [0137.260] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.261] SetLastError (dwErrCode=0x0) [0137.261] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.262] SetLastError (dwErrCode=0x0) [0137.262] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.263] GetLastError () returned 0x0 [0137.263] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.264] SetLastError (dwErrCode=0x0) [0137.264] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.265] GetLastError () returned 0x0 [0137.265] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.266] GetLastError () returned 0x0 [0137.266] SetLastError (dwErrCode=0x0) [0137.267] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0138.047] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=894) returned 1 [0138.047] CloseHandle (hObject=0x614) returned 1 [0138.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5bc0 [0138.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50605c8 [0138.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060cb0 [0138.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x50605c8 | out: hHeap=0x310000) returned 1 [0138.047] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5bc0) returned 1 [0138.047] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394a78 | out: hHeap=0x310000) returned 1 [0138.048] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0138.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5310 [0138.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394c78 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5310 | out: hHeap=0x310000) returned 1 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394c78 | out: hHeap=0x310000) returned 1 [0138.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.048] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3941f8 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.048] SetLastError (dwErrCode=0x0) [0138.048] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.049] SetLastError (dwErrCode=0x0) [0138.049] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.050] GetLastError () returned 0x0 [0138.050] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.051] GetLastError () returned 0x0 [0138.051] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.052] SetLastError (dwErrCode=0x0) [0138.052] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.053] SetLastError (dwErrCode=0x0) [0138.053] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.054] SetLastError (dwErrCode=0x0) [0138.054] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.055] SetLastError (dwErrCode=0x0) [0138.055] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.056] SetLastError (dwErrCode=0x0) [0138.056] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.057] SetLastError (dwErrCode=0x0) [0138.057] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.058] SetLastError (dwErrCode=0x0) [0138.058] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.059] SetLastError (dwErrCode=0x0) [0138.059] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.060] GetLastError () returned 0x0 [0138.060] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.061] GetLastError () returned 0x0 [0138.061] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] GetLastError () returned 0x0 [0138.062] SetLastError (dwErrCode=0x0) [0138.062] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0138.062] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=1150) returned 1 [0138.062] CloseHandle (hObject=0x614) returned 1 [0138.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5ee0 [0138.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060d18 [0138.062] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50605c8 [0138.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060d18 | out: hHeap=0x310000) returned 1 [0138.062] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5ee0) returned 1 [0138.062] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3941f8 | out: hHeap=0x310000) returned 1 [0138.063] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0138.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x393e78 [0138.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x393e78 | out: hHeap=0x310000) returned 1 [0138.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5310 [0138.063] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394bf8 [0138.063] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5310 | out: hHeap=0x310000) returned 1 [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.063] GetLastError () returned 0x0 [0138.063] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.064] GetLastError () returned 0x0 [0138.064] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.124] SetLastError (dwErrCode=0x0) [0138.124] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.125] GetLastError () returned 0x0 [0138.125] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.126] SetLastError (dwErrCode=0x0) [0138.126] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.127] GetLastError () returned 0x0 [0138.127] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.128] SetLastError (dwErrCode=0x0) [0138.128] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.129] SetLastError (dwErrCode=0x0) [0138.129] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.130] SetLastError (dwErrCode=0x0) [0138.130] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.131] GetLastError () returned 0x0 [0138.131] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.132] GetLastError () returned 0x0 [0138.132] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.133] SetLastError (dwErrCode=0x0) [0138.133] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.134] SetLastError (dwErrCode=0x0) [0138.134] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.135] SetLastError (dwErrCode=0x0) [0138.135] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.136] SetLastError (dwErrCode=0x0) [0138.136] GetLastError () returned 0x0 [0138.137] SetLastError (dwErrCode=0x0) [0138.137] GetLastError () returned 0x0 [0138.137] SetLastError (dwErrCode=0x0) [0138.137] GetLastError () returned 0x0 [0138.137] SetLastError (dwErrCode=0x0) [0138.137] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0138.138] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=36710) returned 1 [0138.138] CloseHandle (hObject=0x614) returned 1 [0138.138] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5c60 [0138.138] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060768 [0138.138] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060d18 [0138.138] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060768 | out: hHeap=0x310000) returned 1 [0138.138] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5c60) returned 1 [0138.138] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394bf8 | out: hHeap=0x310000) returned 1 [0138.138] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0138.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5310 [0138.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394a78 [0138.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5310 | out: hHeap=0x310000) returned 1 [0138.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394a78 | out: hHeap=0x310000) returned 1 [0138.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5310 [0138.139] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394678 [0138.139] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5310 | out: hHeap=0x310000) returned 1 [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.139] GetLastError () returned 0x0 [0138.139] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.140] GetLastError () returned 0x0 [0138.140] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.141] SetLastError (dwErrCode=0x0) [0138.141] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.142] GetLastError () returned 0x0 [0138.142] SetLastError (dwErrCode=0x0) [0138.285] GetLastError () returned 0x0 [0138.285] SetLastError (dwErrCode=0x0) [0138.285] GetLastError () returned 0x0 [0138.285] SetLastError (dwErrCode=0x0) [0138.285] GetLastError () returned 0x0 [0138.285] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.286] SetLastError (dwErrCode=0x0) [0138.286] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.287] SetLastError (dwErrCode=0x0) [0138.287] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.288] SetLastError (dwErrCode=0x0) [0138.288] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.289] SetLastError (dwErrCode=0x0) [0138.289] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.290] GetLastError () returned 0x0 [0138.290] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.291] GetLastError () returned 0x0 [0138.291] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.292] SetLastError (dwErrCode=0x0) [0138.292] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.293] GetLastError () returned 0x0 [0138.293] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.294] SetLastError (dwErrCode=0x0) [0138.294] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.295] GetLastError () returned 0x0 [0138.295] SetLastError (dwErrCode=0x0) [0138.296] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0138.296] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=10134) returned 1 [0138.296] CloseHandle (hObject=0x66c) returned 1 [0138.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5b70 [0138.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060eb8 [0138.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060f20 [0138.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060eb8 | out: hHeap=0x310000) returned 1 [0138.296] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5b70) returned 1 [0138.296] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394678 | out: hHeap=0x310000) returned 1 [0138.296] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0138.296] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.297] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394878 [0138.297] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.297] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394878 | out: hHeap=0x310000) returned 1 [0138.297] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0138.297] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394678 [0138.297] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.297] SetLastError (dwErrCode=0x0) [0138.297] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.298] SetLastError (dwErrCode=0x0) [0138.298] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.299] GetLastError () returned 0x0 [0138.299] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.300] SetLastError (dwErrCode=0x0) [0138.300] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.301] GetLastError () returned 0x0 [0138.301] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.302] SetLastError (dwErrCode=0x0) [0138.302] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.303] SetLastError (dwErrCode=0x0) [0138.303] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.304] GetLastError () returned 0x0 [0138.304] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.305] SetLastError (dwErrCode=0x0) [0138.305] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.306] GetLastError () returned 0x0 [0138.306] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.307] GetLastError () returned 0x0 [0138.307] SetLastError (dwErrCode=0x0) [0138.308] GetLastError () returned 0x0 [0138.308] SetLastError (dwErrCode=0x0) [0138.308] GetLastError () returned 0x0 [0138.308] SetLastError (dwErrCode=0x0) [0138.308] GetLastError () returned 0x0 [0138.308] SetLastError (dwErrCode=0x0) [0138.308] GetLastError () returned 0x0 [0138.308] SetLastError (dwErrCode=0x0) [0138.309] GetLastError () returned 0x0 [0138.309] SetLastError (dwErrCode=0x0) [0138.309] GetLastError () returned 0x0 [0138.309] SetLastError (dwErrCode=0x0) [0138.309] GetLastError () returned 0x0 [0138.309] SetLastError (dwErrCode=0x0) [0138.309] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.310] GetLastError () returned 0x0 [0138.310] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.311] SetLastError (dwErrCode=0x0) [0138.311] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.312] SetLastError (dwErrCode=0x0) [0138.312] GetLastError () returned 0x0 [0138.313] SetLastError (dwErrCode=0x0) [0138.313] GetLastError () returned 0x0 [0138.313] SetLastError (dwErrCode=0x0) [0138.313] GetLastError () returned 0x0 [0138.313] SetLastError (dwErrCode=0x0) [0138.313] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0138.313] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=1150) returned 1 [0138.313] CloseHandle (hObject=0x66c) returned 1 [0138.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5df0 [0138.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060f88 [0138.313] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060de8 [0138.313] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060f88 | out: hHeap=0x310000) returned 1 [0138.313] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5df0) returned 1 [0138.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394678 | out: hHeap=0x310000) returned 1 [0138.314] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0138.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394578 [0138.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394578 | out: hHeap=0x310000) returned 1 [0138.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.314] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3948f8 [0138.314] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.314] SetLastError (dwErrCode=0x0) [0138.314] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.315] SetLastError (dwErrCode=0x0) [0138.315] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.316] SetLastError (dwErrCode=0x0) [0138.316] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.317] GetLastError () returned 0x0 [0138.317] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.318] GetLastError () returned 0x0 [0138.318] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.319] GetLastError () returned 0x0 [0138.319] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.320] SetLastError (dwErrCode=0x0) [0138.320] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.321] GetLastError () returned 0x0 [0138.321] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.322] GetLastError () returned 0x0 [0138.322] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.323] GetLastError () returned 0x0 [0138.323] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.324] GetLastError () returned 0x0 [0138.324] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.325] GetLastError () returned 0x0 [0138.325] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.326] SetLastError (dwErrCode=0x0) [0138.326] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.327] SetLastError (dwErrCode=0x0) [0138.327] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] GetLastError () returned 0x0 [0138.328] SetLastError (dwErrCode=0x0) [0138.328] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0138.328] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=1150) returned 1 [0138.328] CloseHandle (hObject=0x66c) returned 1 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5cb0 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b058 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b1c0 [0138.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0138.329] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5cb0) returned 1 [0138.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3948f8 | out: hHeap=0x310000) returned 1 [0138.329] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5730 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x3943f8 [0138.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5730 | out: hHeap=0x310000) returned 1 [0138.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3943f8 | out: hHeap=0x310000) returned 1 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0138.329] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x76) returned 0x394a78 [0138.329] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.329] SetLastError (dwErrCode=0x0) [0138.329] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.330] SetLastError (dwErrCode=0x0) [0138.330] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.482] SetLastError (dwErrCode=0x0) [0138.482] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.483] SetLastError (dwErrCode=0x0) [0138.483] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.484] SetLastError (dwErrCode=0x0) [0138.484] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.485] GetLastError () returned 0x0 [0138.485] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.486] SetLastError (dwErrCode=0x0) [0138.486] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.487] GetLastError () returned 0x0 [0138.487] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.488] GetLastError () returned 0x0 [0138.488] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.489] SetLastError (dwErrCode=0x0) [0138.489] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.490] GetLastError () returned 0x0 [0138.490] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.491] SetLastError (dwErrCode=0x0) [0138.491] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.492] SetLastError (dwErrCode=0x0) [0138.492] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.493] SetLastError (dwErrCode=0x0) [0138.493] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.494] SetLastError (dwErrCode=0x0) [0138.494] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.495] SetLastError (dwErrCode=0x0) [0138.495] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] GetLastError () returned 0x0 [0138.496] SetLastError (dwErrCode=0x0) [0138.496] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0138.496] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x501f0f0 | out: lpFileSize=0x501f0f0*=10134) returned 1 [0138.496] CloseHandle (hObject=0x680) returned 1 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5e40 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x50607d0 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.497] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5e40) returned 1 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x394a78 | out: hHeap=0x310000) returned 1 [0138.497] FindNextFileW (in: hFindFile=0x5260c88, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0138.497] FindClose (in: hFindFile=0x5260c88 | out: hFindFile=0x5260c88) returned 1 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x4c19650 | out: hHeap=0x310000) returned 1 [0138.497] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b880 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b880 | out: hHeap=0x310000) returned 1 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bab0 [0138.497] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0138.497] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bab0 | out: hHeap=0x310000) returned 1 [0138.497] GetLastError () returned 0x12 [0138.497] SetLastError (dwErrCode=0x12) [0138.497] GetLastError () returned 0x12 [0138.497] SetLastError (dwErrCode=0x12) [0138.497] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.498] SetLastError (dwErrCode=0x12) [0138.498] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.499] GetLastError () returned 0x12 [0138.499] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.500] GetLastError () returned 0x12 [0138.500] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.501] GetLastError () returned 0x12 [0138.501] SetLastError (dwErrCode=0x12) [0138.502] GetLastError () returned 0x12 [0138.502] SetLastError (dwErrCode=0x12) [0138.502] GetLastError () returned 0x12 [0138.502] SetLastError (dwErrCode=0x12) [0138.502] GetLastError () returned 0x12 [0138.502] SetLastError (dwErrCode=0x12) [0138.502] GetLastError () returned 0x12 [0138.502] SetLastError (dwErrCode=0x12) [0138.502] GetLastError () returned 0x12 [0138.502] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.513] SetLastError (dwErrCode=0x12) [0138.513] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.514] GetLastError () returned 0x12 [0138.514] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.515] SetLastError (dwErrCode=0x12) [0138.515] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.516] SetLastError (dwErrCode=0x12) [0138.516] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.517] SetLastError (dwErrCode=0x12) [0138.517] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] GetLastError () returned 0x12 [0138.518] SetLastError (dwErrCode=0x12) [0138.518] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5990 [0138.518] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0138.518] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5310 [0138.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0138.519] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5990) returned 1 [0138.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0138.519] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0138.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35ba08 [0138.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0138.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35ba08 | out: hHeap=0x310000) returned 1 [0138.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0138.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b5a8 [0138.519] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e4ff8 [0138.519] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b5a8 | out: hHeap=0x310000) returned 1 [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.519] SetLastError (dwErrCode=0x12) [0138.519] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.520] GetLastError () returned 0x12 [0138.520] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.521] SetLastError (dwErrCode=0x12) [0138.521] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.522] SetLastError (dwErrCode=0x12) [0138.522] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] GetLastError () returned 0x12 [0138.523] SetLastError (dwErrCode=0x12) [0138.523] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0138.528] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=181483595) returned 1 [0138.528] CloseHandle (hObject=0x5bc) returned 1 [0138.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5b20 [0138.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0138.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5368 [0138.529] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0138.529] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5b20) returned 1 [0138.529] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e4ff8 | out: hHeap=0x310000) returned 1 [0138.529] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0138.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0138.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.529] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0138.529] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b998 [0138.529] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.529] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b998 | out: hHeap=0x310000) returned 1 [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.529] SetLastError (dwErrCode=0x0) [0138.529] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.530] SetLastError (dwErrCode=0x0) [0138.530] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.531] SetLastError (dwErrCode=0x0) [0138.531] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.532] SetLastError (dwErrCode=0x0) [0138.532] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.533] GetLastError () returned 0x0 [0138.533] SetLastError (dwErrCode=0x0) [0138.746] GetLastError () returned 0x0 [0138.746] SetLastError (dwErrCode=0x0) [0138.746] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.747] SetLastError (dwErrCode=0x0) [0138.747] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.748] GetLastError () returned 0x0 [0138.748] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.749] SetLastError (dwErrCode=0x0) [0138.749] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.750] GetLastError () returned 0x0 [0138.750] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.751] GetLastError () returned 0x0 [0138.751] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.752] SetLastError (dwErrCode=0x0) [0138.752] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.753] SetLastError (dwErrCode=0x0) [0138.753] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.754] GetLastError () returned 0x0 [0138.754] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.755] GetLastError () returned 0x0 [0138.755] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] GetLastError () returned 0x0 [0138.756] SetLastError (dwErrCode=0x0) [0138.756] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0138.757] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1901056) returned 1 [0138.757] CloseHandle (hObject=0x5bc) returned 1 [0138.757] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5d00 [0138.757] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060d80 [0138.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060e50 [0138.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060d80 | out: hHeap=0x310000) returned 1 [0138.758] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5d00) returned 1 [0138.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.758] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0138.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0138.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0138.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b960 [0138.758] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b960 | out: hHeap=0x310000) returned 1 [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.758] GetLastError () returned 0x0 [0138.758] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.759] SetLastError (dwErrCode=0x0) [0138.759] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.760] SetLastError (dwErrCode=0x0) [0138.760] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.761] GetLastError () returned 0x0 [0138.761] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.762] GetLastError () returned 0x0 [0138.762] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.763] SetLastError (dwErrCode=0x0) [0138.763] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.764] SetLastError (dwErrCode=0x0) [0138.764] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.765] GetLastError () returned 0x0 [0138.765] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.766] SetLastError (dwErrCode=0x0) [0138.766] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.767] SetLastError (dwErrCode=0x0) [0138.767] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.768] SetLastError (dwErrCode=0x0) [0138.768] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.769] GetLastError () returned 0x0 [0138.769] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.770] SetLastError (dwErrCode=0x0) [0138.770] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.771] SetLastError (dwErrCode=0x0) [0138.771] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] GetLastError () returned 0x0 [0138.772] SetLastError (dwErrCode=0x0) [0138.772] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0138.773] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1163264) returned 1 [0138.773] CloseHandle (hObject=0x5bc) returned 1 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e58f0 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060ff0 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060d80 [0138.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060ff0 | out: hHeap=0x310000) returned 1 [0138.773] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e58f0) returned 1 [0138.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.773] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35bb58 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb58 | out: hHeap=0x310000) returned 1 [0138.773] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.773] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b7d8 [0138.774] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060490 [0138.774] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b7d8 | out: hHeap=0x310000) returned 1 [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.774] SetLastError (dwErrCode=0x0) [0138.774] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.775] GetLastError () returned 0x0 [0138.775] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.776] GetLastError () returned 0x0 [0138.776] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.777] SetLastError (dwErrCode=0x0) [0138.777] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.778] GetLastError () returned 0x0 [0138.778] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.779] SetLastError (dwErrCode=0x0) [0138.779] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.780] GetLastError () returned 0x0 [0138.780] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.781] GetLastError () returned 0x0 [0138.781] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.782] GetLastError () returned 0x0 [0138.782] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.783] GetLastError () returned 0x0 [0138.783] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.784] SetLastError (dwErrCode=0x0) [0138.784] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.785] SetLastError (dwErrCode=0x0) [0138.785] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.786] GetLastError () returned 0x0 [0138.786] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.787] SetLastError (dwErrCode=0x0) [0138.787] GetLastError () returned 0x0 [0138.788] SetLastError (dwErrCode=0x0) [0138.788] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0138.788] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=43131591) returned 1 [0138.788] CloseHandle (hObject=0x5bc) returned 1 [0138.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5c10 [0138.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x5060ff0 [0138.788] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a29f8 [0138.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060ff0 | out: hHeap=0x310000) returned 1 [0138.788] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5c10) returned 1 [0138.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5060490 | out: hHeap=0x310000) returned 1 [0138.788] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0138.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b6c0 [0138.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0138.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b6c0 | out: hHeap=0x310000) returned 1 [0138.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0138.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b500 [0138.789] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0138.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b500 | out: hHeap=0x310000) returned 1 [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.789] SetLastError (dwErrCode=0x0) [0138.789] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.790] GetLastError () returned 0x0 [0138.790] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0138.791] SetLastError (dwErrCode=0x0) [0138.791] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.416] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.416] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.416] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.416] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.416] GetLastError () returned 0x0 [0139.416] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.417] GetLastError () returned 0x0 [0139.417] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.418] GetLastError () returned 0x0 [0139.418] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.419] SetLastError (dwErrCode=0x0) [0139.419] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.420] SetLastError (dwErrCode=0x0) [0139.420] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.421] GetLastError () returned 0x0 [0139.421] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.422] SetLastError (dwErrCode=0x0) [0139.422] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.423] GetLastError () returned 0x0 [0139.423] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.424] GetLastError () returned 0x0 [0139.424] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.425] GetLastError () returned 0x0 [0139.425] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.426] GetLastError () returned 0x0 [0139.426] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.427] GetLastError () returned 0x0 [0139.427] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.428] GetLastError () returned 0x0 [0139.428] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.429] GetLastError () returned 0x0 [0139.429] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.430] SetLastError (dwErrCode=0x0) [0139.430] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] GetLastError () returned 0x0 [0139.431] SetLastError (dwErrCode=0x0) [0139.431] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c [0139.433] GetFileSizeEx (in: hFile=0x68c, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=872448) returned 1 [0139.433] CloseHandle (hObject=0x68c) returned 1 [0139.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5f30 [0139.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0139.433] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a28c0 [0139.433] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0139.433] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5f30) returned 1 [0139.434] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0139.434] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0139.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b5a8 [0139.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0139.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b5a8 | out: hHeap=0x310000) returned 1 [0139.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0139.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35b618 [0139.435] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0139.435] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35b618 | out: hHeap=0x310000) returned 1 [0139.435] GetLastError () returned 0x0 [0139.435] SetLastError (dwErrCode=0x0) [0139.435] GetLastError () returned 0x0 [0139.435] SetLastError (dwErrCode=0x0) [0139.435] GetLastError () returned 0x0 [0139.435] SetLastError (dwErrCode=0x0) [0139.435] GetLastError () returned 0x0 [0139.435] SetLastError (dwErrCode=0x0) [0139.435] GetLastError () returned 0x0 [0139.435] SetLastError (dwErrCode=0x0) [0139.435] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.436] SetLastError (dwErrCode=0x0) [0139.436] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.437] GetLastError () returned 0x0 [0139.437] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.438] GetLastError () returned 0x0 [0139.438] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.439] GetLastError () returned 0x0 [0139.439] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.440] GetLastError () returned 0x0 [0139.440] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.441] SetLastError (dwErrCode=0x0) [0139.441] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.442] SetLastError (dwErrCode=0x0) [0139.442] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.443] SetLastError (dwErrCode=0x0) [0139.443] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.444] GetLastError () returned 0x0 [0139.444] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.445] SetLastError (dwErrCode=0x0) [0139.445] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.446] GetLastError () returned 0x0 [0139.446] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.447] GetLastError () returned 0x0 [0139.447] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.523] SetLastError (dwErrCode=0x0) [0139.523] GetLastError () returned 0x0 [0139.524] SetLastError (dwErrCode=0x0) [0139.524] GetLastError () returned 0x0 [0139.524] SetLastError (dwErrCode=0x0) [0139.524] GetLastError () returned 0x0 [0139.524] SetLastError (dwErrCode=0x0) [0139.524] GetLastError () returned 0x0 [0139.524] SetLastError (dwErrCode=0x0) [0139.524] GetLastError () returned 0x0 [0139.524] SetLastError (dwErrCode=0x0) [0139.524] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0139.524] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=495616) returned 1 [0139.524] CloseHandle (hObject=0x4d8) returned 1 [0139.524] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5f80 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a1f00 [0139.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0139.525] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5f80) returned 1 [0139.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0139.525] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0139.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.525] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2858 [0139.525] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.525] SetLastError (dwErrCode=0x0) [0139.525] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.526] GetLastError () returned 0x0 [0139.526] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.527] GetLastError () returned 0x0 [0139.527] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.528] SetLastError (dwErrCode=0x0) [0139.528] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.529] SetLastError (dwErrCode=0x0) [0139.529] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.530] SetLastError (dwErrCode=0x0) [0139.530] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] GetLastError () returned 0x0 [0139.531] SetLastError (dwErrCode=0x0) [0139.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5ad0 [0139.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a2990 [0139.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x60) returned 0x52a21d8 [0139.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2990 | out: hHeap=0x310000) returned 1 [0139.531] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5ad0) returned 1 [0139.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2858 | out: hHeap=0x310000) returned 1 [0139.531] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0139.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.532] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.532] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.532] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.532] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.532] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.532] GetLastError () returned 0x0 [0139.532] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.533] GetLastError () returned 0x0 [0139.533] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.534] GetLastError () returned 0x0 [0139.534] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.535] SetLastError (dwErrCode=0x0) [0139.535] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.536] SetLastError (dwErrCode=0x0) [0139.536] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.537] SetLastError (dwErrCode=0x0) [0139.537] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.538] GetLastError () returned 0x0 [0139.538] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.539] SetLastError (dwErrCode=0x0) [0139.539] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.540] SetLastError (dwErrCode=0x0) [0139.540] GetLastError () returned 0x0 [0139.541] SetLastError (dwErrCode=0x0) [0139.541] GetLastError () returned 0x0 [0139.541] SetLastError (dwErrCode=0x0) [0139.541] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0139.542] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=184832) returned 1 [0139.542] CloseHandle (hObject=0x4d8) returned 1 [0139.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5850 [0139.542] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d78 [0139.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398e80 [0139.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d78 | out: hHeap=0x310000) returned 1 [0139.543] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5850) returned 1 [0139.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.543] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0139.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.543] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.543] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.543] GetLastError () returned 0x0 [0139.543] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.544] GetLastError () returned 0x0 [0139.544] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.545] GetLastError () returned 0x0 [0139.545] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.546] SetLastError (dwErrCode=0x0) [0139.546] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.547] SetLastError (dwErrCode=0x0) [0139.547] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.548] SetLastError (dwErrCode=0x0) [0139.548] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.549] GetLastError () returned 0x0 [0139.549] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.550] GetLastError () returned 0x0 [0139.550] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.551] GetLastError () returned 0x0 [0139.551] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.552] SetLastError (dwErrCode=0x0) [0139.552] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.553] GetLastError () returned 0x0 [0139.553] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.554] GetLastError () returned 0x0 [0139.554] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.555] GetLastError () returned 0x0 [0139.555] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.556] SetLastError (dwErrCode=0x0) [0139.556] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.557] SetLastError (dwErrCode=0x0) [0139.557] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.911] SetLastError (dwErrCode=0x0) [0139.911] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] GetLastError () returned 0x0 [0139.912] SetLastError (dwErrCode=0x0) [0139.912] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.912] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=94720) returned 1 [0139.912] CloseHandle (hObject=0x610) returned 1 [0139.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e59e0 [0139.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5470 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.913] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e59e0) returned 1 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.913] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0139.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.914] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0139.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e52b8 | out: hHeap=0x310000) returned 1 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.914] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.914] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.915] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=30120) returned 1 [0139.915] CloseHandle (hObject=0x610) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e5a30 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e52b8 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0139.915] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e5a30) returned 1 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0139.915] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0139.915] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365bd8 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399350 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0139.916] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365bd8) returned 1 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5578 | out: hHeap=0x310000) returned 1 [0139.916] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0139.916] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.916] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365a48 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d78 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3999d8 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d78 | out: hHeap=0x310000) returned 1 [0139.917] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365a48) returned 1 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.917] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d78 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365368 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5578 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.917] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365368) returned 1 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d78 | out: hHeap=0x310000) returned 1 [0139.917] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0139.917] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x51e5628 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365688 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d20 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x398d78 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x398d20 | out: hHeap=0x310000) returned 1 [0139.918] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365688) returned 1 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51e5628 | out: hHeap=0x310000) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0139.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.918] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.919] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=5198099) returned 1 [0139.919] CloseHandle (hObject=0x610) returned 1 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365408 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364ef0 [0139.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0139.919] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365408) returned 1 [0139.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364bc0 | out: hHeap=0x310000) returned 1 [0139.919] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.919] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0139.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.920] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.920] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=2192672) returned 1 [0139.920] CloseHandle (hObject=0x610) returned 1 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365458 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364f78 [0139.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0139.920] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365458) returned 1 [0139.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0139.920] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365110 [0139.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365110 | out: hHeap=0x310000) returned 1 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c338 [0139.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.920] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c338 | out: hHeap=0x310000) returned 1 [0139.920] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.921] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=5091790) returned 1 [0139.921] CloseHandle (hObject=0x610) returned 1 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19650 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364bc0 [0139.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0139.921] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19650) returned 1 [0139.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364670 | out: hHeap=0x310000) returned 1 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x30) returned 0x35c300 [0139.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0139.921] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x310000) returned 1 [0139.921] CreateFileW (lpFileName="C:\\\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0139.921] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=2141433) returned 1 [0139.921] CloseHandle (hObject=0x610) returned 1 [0139.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c191f0 [0139.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0139.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364670 [0139.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0139.922] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c191f0) returned 1 [0139.922] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365000 | out: hHeap=0x310000) returned 1 [0139.922] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0139.922] FindClose (in: hFindFile=0x35d9c8 | out: hFindFile=0x35d9c8) returned 1 [0141.692] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb90 | out: hHeap=0x310000) returned 1 [0141.692] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0141.692] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0141.692] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0141.692] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0141.692] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0141.693] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0141.693] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0141.693] FindFirstFileW (in: lpFileName="C:\\\\ESD\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d9c8 [0141.696] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0141.697] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.697] FindNextFileW (in: hFindFile=0x35d9c8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.697] FindClose (in: hFindFile=0x35d9c8 | out: hFindFile=0x35d9c8) returned 1 [0141.697] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab460c6f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0141.697] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0141.697] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0141.697] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0141.697] FindFirstFileW (in: lpFileName="C:\\\\Logs\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d908 [0141.757] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0141.757] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.761] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0141.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0141.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0141.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0141.761] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0141.762] CreateFileW (lpFileName="C:\\\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0141.808] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0141.808] CloseHandle (hObject=0x690) returned 1 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18b10 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d98 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397648 [0141.808] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d98 | out: hHeap=0x310000) returned 1 [0141.808] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18b10) returned 1 [0141.808] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.808] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.808] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0141.808] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0141.808] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.809] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0141.809] CreateFileW (lpFileName="C:\\\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.877] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0141.878] CloseHandle (hObject=0x518) returned 1 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18bb0 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d98 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397768 [0141.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d98 | out: hHeap=0x310000) returned 1 [0141.878] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18bb0) returned 1 [0141.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d98 [0141.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0141.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d98 | out: hHeap=0x310000) returned 1 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0141.878] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d08 [0141.878] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0141.878] CreateFileW (lpFileName="C:\\\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.879] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0141.879] CloseHandle (hObject=0x518) returned 1 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18de0 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397d98 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x40) returned 0x397a38 [0141.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d98 | out: hHeap=0x310000) returned 1 [0141.879] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18de0) returned 1 [0141.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x397d08 | out: hHeap=0x310000) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399198 [0141.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0141.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399198 | out: hHeap=0x310000) returned 1 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0141.879] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399090 [0141.879] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0141.879] CreateFileW (lpFileName="C:\\\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.880] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0141.880] CloseHandle (hObject=0x518) returned 1 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3655e8 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x3990e8 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x50) returned 0x399140 [0141.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3990e8 | out: hHeap=0x310000) returned 1 [0141.880] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3655e8) returned 1 [0141.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x399090 | out: hHeap=0x310000) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0141.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0141.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364c48 [0141.880] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0141.880] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0141.881] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0141.881] CloseHandle (hObject=0x518) returned 1 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365818 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365198 [0141.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0141.881] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365818) returned 1 [0141.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364c48 | out: hHeap=0x310000) returned 1 [0141.881] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390550 [0141.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0141.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390550 | out: hHeap=0x310000) returned 1 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0141.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3912f8 [0141.881] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0141.881] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0143.192] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.192] CloseHandle (hObject=0x5f8) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365868 [0143.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390d38 [0143.192] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390df0 [0143.192] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390d38 | out: hHeap=0x310000) returned 1 [0143.192] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365868) returned 1 [0143.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3912f8 | out: hHeap=0x310000) returned 1 [0143.193] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x391468 [0143.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x391468 | out: hHeap=0x310000) returned 1 [0143.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.193] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390830 [0143.193] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.193] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.229] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0143.229] CloseHandle (hObject=0x678) returned 1 [0143.229] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365a98 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3913b0 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x391188 [0143.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3913b0 | out: hHeap=0x310000) returned 1 [0143.230] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365a98) returned 1 [0143.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390830 | out: hHeap=0x310000) returned 1 [0143.230] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0143.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.230] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b148 [0143.230] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.230] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.231] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.231] CloseHandle (hObject=0x678) returned 1 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x3658b8 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b0d0 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b238 [0143.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b0d0 | out: hHeap=0x310000) returned 1 [0143.231] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x3658b8) returned 1 [0143.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b148 | out: hHeap=0x310000) returned 1 [0143.231] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0143.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.231] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.231] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.232] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.232] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.232] CloseHandle (hObject=0x678) returned 1 [0143.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x365ae8 [0143.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0143.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365000 [0143.232] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364d58 | out: hHeap=0x310000) returned 1 [0143.232] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x365ae8) returned 1 [0143.232] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.232] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0143.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.232] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c3b0 [0143.232] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.232] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c3b0 | out: hHeap=0x310000) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cdc8 [0143.233] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.233] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.233] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.233] CloseHandle (hObject=0x678) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c19380 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c9a0 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cd30 [0143.233] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c9a0 | out: hHeap=0x310000) returned 1 [0143.233] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c19380) returned 1 [0143.233] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cdc8 | out: hHeap=0x310000) returned 1 [0143.233] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0143.233] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c740 [0143.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c740 | out: hHeap=0x310000) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cc98 [0143.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.234] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.234] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.234] CloseHandle (hObject=0x678) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18e80 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c4e0 [0143.234] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c150 [0143.234] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c4e0 | out: hHeap=0x310000) returned 1 [0143.235] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18e80) returned 1 [0143.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cc98 | out: hHeap=0x310000) returned 1 [0143.235] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0143.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0143.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.235] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b058 [0143.235] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.235] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.236] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.236] CloseHandle (hObject=0x678) returned 1 [0143.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x4c18f70 [0143.236] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39afe0 [0143.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae00 [0143.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39afe0 | out: hHeap=0x310000) returned 1 [0143.237] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x4c18f70) returned 1 [0143.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b058 | out: hHeap=0x310000) returned 1 [0143.237] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0143.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b2b0 | out: hHeap=0x310000) returned 1 [0143.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.237] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0143.237] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.237] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.237] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.237] CloseHandle (hObject=0x678) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e58a0 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae78 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b2b0 [0143.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae78 | out: hHeap=0x310000) returned 1 [0143.238] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e58a0) returned 1 [0143.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0143.238] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0143.238] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.238] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0143.238] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.241] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1118208) returned 1 [0143.241] CloseHandle (hObject=0x678) returned 1 [0143.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6790 [0143.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.241] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364d58 [0143.241] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.241] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6790) returned 1 [0143.241] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.242] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.242] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.242] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.242] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0143.242] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.242] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.242] CloseHandle (hObject=0x678) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6420 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.242] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365110 [0143.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.243] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6420) returned 1 [0143.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.243] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0143.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c6a8 [0143.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c6a8 | out: hHeap=0x310000) returned 1 [0143.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0143.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c610 [0143.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0143.243] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.243] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=2166784) returned 1 [0143.243] CloseHandle (hObject=0x678) returned 1 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6380 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c0b8 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cc00 [0143.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c0b8 | out: hHeap=0x310000) returned 1 [0143.249] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6380) returned 1 [0143.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c610 | out: hHeap=0x310000) returned 1 [0143.249] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cc98 [0143.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cc98 | out: hHeap=0x310000) returned 1 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.249] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c6a8 [0143.249] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.249] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.258] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.258] CloseHandle (hObject=0x678) returned 1 [0143.258] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e62e0 [0143.258] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c280 [0143.258] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c740 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c280 | out: hHeap=0x310000) returned 1 [0143.259] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e62e0) returned 1 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c6a8 | out: hHeap=0x310000) returned 1 [0143.259] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.259] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.259] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.259] CloseHandle (hObject=0x678) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6740 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364340 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.259] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6740) returned 1 [0143.259] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.259] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.259] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3715a8 [0143.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3715a8 | out: hHeap=0x310000) returned 1 [0143.260] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.260] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x371a40 [0143.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.260] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.267] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.267] CloseHandle (hObject=0x678) returned 1 [0143.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6240 [0143.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3715a8 [0143.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3717a0 [0143.267] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3715a8 | out: hHeap=0x310000) returned 1 [0143.267] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6240) returned 1 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x371a40 | out: hHeap=0x310000) returned 1 [0143.268] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x364b38 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0143.268] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.268] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.268] CloseHandle (hObject=0x678) returned 1 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6290 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x365088 [0143.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9f28 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x365088 | out: hHeap=0x310000) returned 1 [0143.268] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6290) returned 1 [0143.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x364b38 | out: hHeap=0x310000) returned 1 [0143.268] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eac70 [0143.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eac70 | out: hHeap=0x310000) returned 1 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea830 [0143.269] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.269] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.269] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.269] CloseHandle (hObject=0x678) returned 1 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e67e0 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea698 [0143.269] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea148 [0143.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0143.270] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e67e0) returned 1 [0143.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea830 | out: hHeap=0x310000) returned 1 [0143.270] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3715a8 [0143.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3715a8 | out: hHeap=0x310000) returned 1 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x3715a8 [0143.270] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.270] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.270] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.270] CloseHandle (hObject=0x678) returned 1 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e63d0 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x371a40 [0143.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xa0) returned 0x5c931f8 [0143.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x371a40 | out: hHeap=0x310000) returned 1 [0143.271] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e63d0) returned 1 [0143.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3715a8 | out: hHeap=0x310000) returned 1 [0143.271] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea3f0 [0143.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea3f0 | out: hHeap=0x310000) returned 1 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea2e0 [0143.271] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.271] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.271] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.271] CloseHandle (hObject=0x678) returned 1 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6880 [0143.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea258 [0143.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea940 [0143.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea258 | out: hHeap=0x310000) returned 1 [0143.272] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6880) returned 1 [0143.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea2e0 | out: hHeap=0x310000) returned 1 [0143.272] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0143.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0143.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.272] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaad8 [0143.272] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.272] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.273] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.273] CloseHandle (hObject=0x678) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6330 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9fb0 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ead80 [0143.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9fb0 | out: hHeap=0x310000) returned 1 [0143.273] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6330) returned 1 [0143.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0143.273] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x390608 [0143.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x390608 | out: hHeap=0x310000) returned 1 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.273] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3912f8 [0143.273] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.273] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.273] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0143.274] CloseHandle (hObject=0x678) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6600 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3913b0 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0xb0) returned 0x3909a0 [0143.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3913b0 | out: hHeap=0x310000) returned 1 [0143.274] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6600) returned 1 [0143.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3912f8 | out: hHeap=0x310000) returned 1 [0143.274] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9fb0 [0143.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9fb0 | out: hHeap=0x310000) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea3f0 [0143.274] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.274] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.274] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.274] CloseHandle (hObject=0x678) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6060 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea0c0 [0143.274] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea478 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea0c0 | out: hHeap=0x310000) returned 1 [0143.275] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6060) returned 1 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea3f0 | out: hHeap=0x310000) returned 1 [0143.275] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea698 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.275] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.275] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.275] CloseHandle (hObject=0x678) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6560 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eabe8 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea2e0 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eabe8 | out: hHeap=0x310000) returned 1 [0143.275] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6560) returned 1 [0143.275] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0143.275] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0143.275] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0143.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0143.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac98 [0143.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0143.276] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.276] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.276] CloseHandle (hObject=0x678) returned 1 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e60b0 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0143.276] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac20 [0143.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0143.276] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e60b0) returned 1 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ac98 | out: hHeap=0x310000) returned 1 [0143.277] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ae78 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ae78 | out: hHeap=0x310000) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39b328 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.277] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.277] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.277] CloseHandle (hObject=0x678) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6470 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ad10 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x70) returned 0x39ac98 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39ad10 | out: hHeap=0x310000) returned 1 [0143.277] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6470) returned 1 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39b328 | out: hHeap=0x310000) returned 1 [0143.277] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.277] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea9c8 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.277] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea9c8 | out: hHeap=0x310000) returned 1 [0143.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0143.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.278] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.278] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.278] CloseHandle (hObject=0x678) returned 1 [0143.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6510 [0143.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea038 [0143.278] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea1d0 [0143.278] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea038 | out: hHeap=0x310000) returned 1 [0143.278] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6510) returned 1 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39bef0 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39bef0 | out: hHeap=0x310000) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c2a0 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c908 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c2a0 | out: hHeap=0x310000) returned 1 [0143.279] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.279] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.279] CloseHandle (hObject=0x678) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e64c0 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39cc98 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c020 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39cc98 | out: hHeap=0x310000) returned 1 [0143.279] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e64c0) returned 1 [0143.279] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c908 | out: hHeap=0x310000) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.279] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaad8 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea368 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0143.280] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0143.280] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.280] CloseHandle (hObject=0x678) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e61f0 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9ea0 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eacf8 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9ea0 | out: hHeap=0x310000) returned 1 [0143.280] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e61f0) returned 1 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea368 | out: hHeap=0x310000) returned 1 [0143.280] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9fb0 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9fb0 | out: hHeap=0x310000) returned 1 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c340 [0143.280] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea368 [0143.280] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c340 | out: hHeap=0x310000) returned 1 [0143.281] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.548] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.548] CloseHandle (hObject=0x588) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6100 [0143.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0143.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea7a8 [0143.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0143.548] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6100) returned 1 [0143.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea368 | out: hHeap=0x310000) returned 1 [0143.548] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.548] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9fb0 [0143.548] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9fb0 | out: hHeap=0x310000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eab60 [0143.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.549] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.549] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.549] CloseHandle (hObject=0x588) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6830 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea9c8 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea368 [0143.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea9c8 | out: hHeap=0x310000) returned 1 [0143.549] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6830) returned 1 [0143.549] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eab60 | out: hHeap=0x310000) returned 1 [0143.549] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.549] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea720 [0143.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea720 | out: hHeap=0x310000) returned 1 [0143.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea258 [0143.550] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.550] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.550] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.550] CloseHandle (hObject=0x588) returned 1 [0143.550] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e61a0 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea038 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea3f0 [0143.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea038 | out: hHeap=0x310000) returned 1 [0143.551] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e61a0) returned 1 [0143.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea258 | out: hHeap=0x310000) returned 1 [0143.551] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea8b8 [0143.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea8b8 | out: hHeap=0x310000) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaf18 [0143.551] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.551] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.551] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.551] CloseHandle (hObject=0x588) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6150 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea588 [0143.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0143.552] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6150) returned 1 [0143.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0143.552] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae08 [0143.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0143.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3e9ea0 [0143.552] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0143.552] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.552] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.552] CloseHandle (hObject=0x588) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e65b0 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea830 [0143.552] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea720 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea830 | out: hHeap=0x310000) returned 1 [0143.553] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e65b0) returned 1 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3e9ea0 | out: hHeap=0x310000) returned 1 [0143.553] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaf18 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4a8 | out: hHeap=0x310000) returned 1 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea258 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0143.553] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.553] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0143.553] CloseHandle (hObject=0x588) returned 1 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6650 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae90 [0143.553] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea9c8 [0143.553] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae90 | out: hHeap=0x310000) returned 1 [0143.553] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6650) returned 1 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea258 | out: hHeap=0x310000) returned 1 [0143.554] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c0b8 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c0b8 | out: hHeap=0x310000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c9a0 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.554] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.554] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.554] CloseHandle (hObject=0x588) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e66a0 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c870 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x90) returned 0x39c908 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c870 | out: hHeap=0x310000) returned 1 [0143.554] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e66a0) returned 1 [0143.554] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c9a0 | out: hHeap=0x310000) returned 1 [0143.554] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c1b0 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0143.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c1b0 | out: hHeap=0x310000) returned 1 [0143.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0143.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.555] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.555] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.555] CloseHandle (hObject=0x588) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e66f0 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea830 [0143.555] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea8b8 [0143.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea830 | out: hHeap=0x310000) returned 1 [0143.555] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e66f0) returned 1 [0143.555] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0143.555] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0143.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3ea500 [0143.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c430 | out: hHeap=0x310000) returned 1 [0143.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea500 | out: hHeap=0x310000) returned 1 [0143.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0143.556] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaf18 [0143.556] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0143.558] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.558] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.558] CloseHandle (hObject=0x588) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x44) returned 0x51e6970 [0143.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eaa50 [0143.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x80) returned 0x3eae90 [0143.558] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0143.558] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x51e6970) returned 1 [0143.558] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0143.558] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4a8 [0143.558] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.566] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.566] CloseHandle (hObject=0x584) returned 1 [0143.566] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0143.566] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.567] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.567] CloseHandle (hObject=0x584) returned 1 [0143.567] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0143.567] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.567] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.567] CloseHandle (hObject=0x584) returned 1 [0143.567] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0143.568] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.568] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.568] CloseHandle (hObject=0x584) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0143.568] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.568] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.568] CloseHandle (hObject=0x584) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0143.568] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.568] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.568] CloseHandle (hObject=0x584) returned 1 [0143.569] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0143.569] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.569] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.569] CloseHandle (hObject=0x584) returned 1 [0143.569] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0143.569] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.569] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.569] CloseHandle (hObject=0x584) returned 1 [0143.569] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0143.569] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.570] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.570] CloseHandle (hObject=0x584) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0143.570] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0143.570] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.570] CloseHandle (hObject=0x584) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0143.570] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.574] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.574] CloseHandle (hObject=0x588) returned 1 [0143.574] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0143.574] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.574] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.574] CloseHandle (hObject=0x588) returned 1 [0143.574] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0143.574] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.575] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0143.575] CloseHandle (hObject=0x588) returned 1 [0143.575] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0143.575] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.575] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0143.575] CloseHandle (hObject=0x588) returned 1 [0145.166] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0145.166] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0145.166] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.166] CloseHandle (hObject=0x588) returned 1 [0145.166] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0145.166] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0145.167] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.167] CloseHandle (hObject=0x588) returned 1 [0145.167] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0145.167] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0145.167] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.167] CloseHandle (hObject=0x588) returned 1 [0145.167] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0145.167] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0145.167] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.167] CloseHandle (hObject=0x588) returned 1 [0145.167] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0145.167] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0145.168] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.168] CloseHandle (hObject=0x588) returned 1 [0145.168] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0145.168] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0145.178] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.178] CloseHandle (hObject=0x610) returned 1 [0145.178] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0145.179] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0145.179] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.179] CloseHandle (hObject=0x610) returned 1 [0145.179] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0145.179] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0145.179] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.179] CloseHandle (hObject=0x610) returned 1 [0145.179] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0145.180] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0145.180] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.180] CloseHandle (hObject=0x610) returned 1 [0145.180] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0145.180] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0145.180] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.180] CloseHandle (hObject=0x610) returned 1 [0145.180] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0145.180] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.184] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.184] CloseHandle (hObject=0x618) returned 1 [0145.185] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0145.185] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.185] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.185] CloseHandle (hObject=0x618) returned 1 [0145.185] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0145.185] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.185] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.185] CloseHandle (hObject=0x618) returned 1 [0145.185] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0145.185] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.186] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.186] CloseHandle (hObject=0x618) returned 1 [0145.205] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0145.205] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.229] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.229] CloseHandle (hObject=0x608) returned 1 [0145.229] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0145.230] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.230] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.230] CloseHandle (hObject=0x608) returned 1 [0145.230] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0145.230] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.231] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.231] CloseHandle (hObject=0x608) returned 1 [0145.231] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0145.231] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.231] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.231] CloseHandle (hObject=0x608) returned 1 [0145.231] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0145.231] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.231] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.231] CloseHandle (hObject=0x608) returned 1 [0145.231] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0145.231] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.231] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.232] CloseHandle (hObject=0x608) returned 1 [0145.232] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0145.232] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.233] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.233] CloseHandle (hObject=0x608) returned 1 [0145.233] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0145.233] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.233] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.233] CloseHandle (hObject=0x608) returned 1 [0145.233] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0145.233] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.233] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.233] CloseHandle (hObject=0x608) returned 1 [0145.233] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0145.234] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.234] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.234] CloseHandle (hObject=0x608) returned 1 [0145.234] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0145.234] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.234] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.234] CloseHandle (hObject=0x608) returned 1 [0145.234] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0145.234] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.235] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0145.235] CloseHandle (hObject=0x608) returned 1 [0145.235] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0145.235] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.236] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.236] CloseHandle (hObject=0x608) returned 1 [0145.236] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0145.236] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.236] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.236] CloseHandle (hObject=0x608) returned 1 [0145.236] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0145.236] CreateFileW (lpFileName="C:\\\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.236] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1052672) returned 1 [0145.236] CloseHandle (hObject=0x608) returned 1 [0145.236] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0145.236] CreateFileW (lpFileName="C:\\\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.237] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1118208) returned 1 [0145.237] CloseHandle (hObject=0x608) returned 1 [0145.237] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0145.237] CreateFileW (lpFileName="C:\\\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.237] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.237] CloseHandle (hObject=0x608) returned 1 [0145.237] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0145.237] CreateFileW (lpFileName="C:\\\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.238] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=1118208) returned 1 [0145.238] CloseHandle (hObject=0x608) returned 1 [0145.238] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0145.238] CreateFileW (lpFileName="C:\\\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0145.238] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x501f3f0 | out: lpFileSize=0x501f3f0*=69632) returned 1 [0145.238] CloseHandle (hObject=0x608) returned 1 [0145.238] FindNextFileW (in: hFindFile=0x35d908, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0145.238] FindClose (in: hFindFile=0x35d908 | out: hFindFile=0x35d908) returned 1 [0145.239] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0145.239] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaced8ceb, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0145.239] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0145.239] FindFirstFileW (in: lpFileName="C:\\\\PerfLogs\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e08 [0145.240] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0145.240] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.240] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0145.240] FindClose (in: hFindFile=0x5260e08 | out: hFindFile=0x5260e08) returned 1 [0145.240] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0145.240] FindNextFileW (in: hFindFile=0x35de08, lpFindFileData=0x501f840 | out: lpFindFileData=0x501f840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf3fd2aa1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3fd2aa1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0145.241] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\*", lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf3fd2aa1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3fd2aa1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260ec8 [0145.241] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bb20 | out: hHeap=0x310000) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x5260ec8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf3fd2aa1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3fd2aa1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x5260ec8, lpFindFileData=0x501f544 | out: lpFindFileData=0x501f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xebe00b5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xebe00b5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0145.241] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\*", lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xebe00b5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xebe00b5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e08 [0145.241] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3996c0 | out: hHeap=0x310000) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xebe00b5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xebe00b5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0145.241] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261288 [0145.260] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a23e0 | out: hHeap=0x310000) returned 1 [0145.260] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.260] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0145.260] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0145.261] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x501edf0 | out: lpFileSize=0x501edf0*=15984) returned 1 [0145.261] CloseHandle (hObject=0x618) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5261288, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0145.261] FindClose (in: hFindFile=0x5261288 | out: hFindFile=0x5261288) returned 1 [0145.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x52a2378 | out: hHeap=0x310000) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c8b4a0, ftCreationTime.dwHighDateTime=0x1d5e3a3, ftLastAccessTime.dwLowDateTime=0x8a706ed0, ftLastAccessTime.dwHighDateTime=0x1d5d799, ftLastWriteTime.dwLowDateTime=0x8a706ed0, ftLastWriteTime.dwHighDateTime=0x1d5d799, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64061400, ftCreationTime.dwHighDateTime=0x1d5dbd3, ftLastAccessTime.dwLowDateTime=0x4ffaf690, ftLastAccessTime.dwHighDateTime=0x1d572b2, ftLastWriteTime.dwLowDateTime=0x4ffaf690, ftLastWriteTime.dwHighDateTime=0x1d572b2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb50d9e0, ftCreationTime.dwHighDateTime=0x1d5efd3, ftLastAccessTime.dwLowDateTime=0xc763de20, ftLastAccessTime.dwHighDateTime=0x1d58fd3, ftLastWriteTime.dwLowDateTime=0xc763de20, ftLastWriteTime.dwHighDateTime=0x1d58fd3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="heating.exe", cAlternateFileName="")) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3cdfa30, ftCreationTime.dwHighDateTime=0x1d5e861, ftLastAccessTime.dwLowDateTime=0x5479e190, ftLastAccessTime.dwHighDateTime=0x1d58e96, ftLastWriteTime.dwLowDateTime=0x5479e190, ftLastWriteTime.dwHighDateTime=0x1d58e96, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mature.exe", cAlternateFileName="")) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260e08, lpFindFileData=0x501f248 | out: lpFindFileData=0x501f248*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0145.261] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260d88 [0145.261] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19600 | out: hHeap=0x310000) returned 1 [0145.261] FindNextFileW (in: hFindFile=0x5260d88, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.262] FindNextFileW (in: hFindFile=0x5260d88, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0145.262] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260f88 [0145.262] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaa50 | out: hHeap=0x310000) returned 1 [0145.262] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0145.263] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0145.264] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0145.265] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0145.266] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x501eaf0 | out: lpFileSize=0x501eaf0*=102) returned 1 [0145.266] CloseHandle (hObject=0x4ac) returned 1 [0145.266] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0145.266] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0145.267] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x501eaf0 | out: lpFileSize=0x501eaf0*=102) returned 1 [0145.267] CloseHandle (hObject=0x4ac) returned 1 [0145.267] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0145.267] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0145.267] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0145.267] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0145.267] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0145.268] FindClose (in: hFindFile=0x5260f88 | out: hFindFile=0x5260f88) returned 1 [0145.268] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326980 | out: hHeap=0x310000) returned 1 [0145.268] FindNextFileW (in: hFindFile=0x5260d88, lpFindFileData=0x501ef4c | out: lpFindFileData=0x501ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0145.268] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260f88 [0145.615] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5d19948 | out: hHeap=0x310000) returned 1 [0145.615] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.615] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0145.615] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0145.615] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261188 [0145.616] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.616] FindNextFileW (in: hFindFile=0x5261188, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.616] FindNextFileW (in: hFindFile=0x5261188, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.616] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.617] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.617] CloseHandle (hObject=0x4e4) returned 1 [0145.617] FindNextFileW (in: hFindFile=0x5261188, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.617] FindClose (in: hFindFile=0x5261188 | out: hFindFile=0x5261188) returned 1 [0145.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326e50 | out: hHeap=0x310000) returned 1 [0145.617] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0145.617] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0145.617] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.617] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.617] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.618] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.618] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.618] CloseHandle (hObject=0x4e4) returned 1 [0145.618] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.618] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0145.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326cf0 | out: hHeap=0x310000) returned 1 [0145.618] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0145.618] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0145.618] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0145.618] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.618] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.618] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.618] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.619] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=9728) returned 1 [0145.619] CloseHandle (hObject=0x4e4) returned 1 [0145.619] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.619] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0145.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326cf0 | out: hHeap=0x310000) returned 1 [0145.619] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0145.619] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e88 [0145.619] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.619] FindNextFileW (in: hFindFile=0x5260e88, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.619] FindNextFileW (in: hFindFile=0x5260e88, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.619] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.620] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10240) returned 1 [0145.620] CloseHandle (hObject=0x4e4) returned 1 [0145.620] FindNextFileW (in: hFindFile=0x5260e88, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.620] FindClose (in: hFindFile=0x5260e88 | out: hFindFile=0x5260e88) returned 1 [0145.620] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326820 | out: hHeap=0x310000) returned 1 [0145.620] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0145.620] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0145.621] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0145.621] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.621] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.621] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.621] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.621] CloseHandle (hObject=0x4e4) returned 1 [0145.621] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.622] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0145.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326da0 | out: hHeap=0x310000) returned 1 [0145.622] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0145.622] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260b48 [0145.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaad8 | out: hHeap=0x310000) returned 1 [0145.622] FindNextFileW (in: hFindFile=0x5260b48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.622] FindNextFileW (in: hFindFile=0x5260b48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.622] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.622] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.622] CloseHandle (hObject=0x4e4) returned 1 [0145.622] FindNextFileW (in: hFindFile=0x5260b48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.622] FindClose (in: hFindFile=0x5260b48 | out: hFindFile=0x5260b48) returned 1 [0145.622] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326b90 | out: hHeap=0x310000) returned 1 [0145.622] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0145.622] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260fc8 [0145.623] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea0c0 | out: hHeap=0x310000) returned 1 [0145.623] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.623] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.623] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.623] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=9728) returned 1 [0145.623] CloseHandle (hObject=0x4e4) returned 1 [0145.624] FindNextFileW (in: hFindFile=0x5260fc8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.624] FindClose (in: hFindFile=0x5260fc8 | out: hFindFile=0x5260fc8) returned 1 [0145.624] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326ae0 | out: hHeap=0x310000) returned 1 [0145.624] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.624] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0145.625] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.625] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.625] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0145.625] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0145.625] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0145.626] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0145.626] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0145.626] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0145.626] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0145.626] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.626] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=8704) returned 1 [0145.626] CloseHandle (hObject=0x4e4) returned 1 [0145.627] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0145.627] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.627] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=5120) returned 1 [0145.627] CloseHandle (hObject=0x4e4) returned 1 [0145.627] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0145.627] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.628] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=3072) returned 1 [0145.628] CloseHandle (hObject=0x4e4) returned 1 [0145.628] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0145.628] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.628] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=23040) returned 1 [0145.628] CloseHandle (hObject=0x4e4) returned 1 [0145.628] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0145.629] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.629] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=2560) returned 1 [0145.629] CloseHandle (hObject=0x4e4) returned 1 [0145.629] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0145.629] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0145.629] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.630] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=9216) returned 1 [0145.630] CloseHandle (hObject=0x4e4) returned 1 [0145.630] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0145.630] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.631] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.631] CloseHandle (hObject=0x4e4) returned 1 [0145.631] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0145.631] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.631] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=3072) returned 1 [0145.631] CloseHandle (hObject=0x4e4) returned 1 [0145.631] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0145.632] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.632] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=3072) returned 1 [0145.632] CloseHandle (hObject=0x4e4) returned 1 [0145.632] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0145.632] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.633] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=44032) returned 1 [0145.633] CloseHandle (hObject=0x4e4) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0145.633] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.634] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=5120) returned 1 [0145.634] CloseHandle (hObject=0x4e4) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0145.634] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.634] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=2560) returned 1 [0145.634] CloseHandle (hObject=0x4e4) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0145.634] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.635] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=25088) returned 1 [0145.635] CloseHandle (hObject=0x4e4) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.635] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.635] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=9728) returned 1 [0145.635] CloseHandle (hObject=0x4e4) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0145.635] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.635] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=3584) returned 1 [0145.636] CloseHandle (hObject=0x4e4) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0145.638] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0145.638] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326610 | out: hHeap=0x310000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0145.638] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0145.639] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.639] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.639] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.639] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.639] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.639] CloseHandle (hObject=0x4e4) returned 1 [0145.639] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.639] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0145.639] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326ae0 | out: hHeap=0x310000) returned 1 [0145.639] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0145.639] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0145.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.640] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.640] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.640] CloseHandle (hObject=0x4e4) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.640] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0145.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326cf0 | out: hHeap=0x310000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0145.640] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261108 [0145.640] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5261108, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x5261108, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.641] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.641] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10752) returned 1 [0145.641] CloseHandle (hObject=0x4e4) returned 1 [0145.641] FindNextFileW (in: hFindFile=0x5261108, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.641] FindClose (in: hFindFile=0x5261108 | out: hFindFile=0x5261108) returned 1 [0145.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326770 | out: hHeap=0x310000) returned 1 [0145.641] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0145.641] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260d08 [0145.641] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eae08 | out: hHeap=0x310000) returned 1 [0145.641] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.641] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.641] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.642] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=10240) returned 1 [0145.642] CloseHandle (hObject=0x4e4) returned 1 [0145.642] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.642] FindClose (in: hFindFile=0x5260d08 | out: hFindFile=0x5260d08) returned 1 [0145.642] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326cf0 | out: hHeap=0x310000) returned 1 [0145.642] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0145.642] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0145.642] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0145.642] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260e48 [0145.643] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3ea698 | out: hHeap=0x310000) returned 1 [0145.643] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.643] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.643] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.644] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=11264) returned 1 [0145.644] CloseHandle (hObject=0x4e4) returned 1 [0145.644] FindNextFileW (in: hFindFile=0x5260e48, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.644] FindClose (in: hFindFile=0x5260e48 | out: hFindFile=0x5260e48) returned 1 [0145.644] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3268d0 | out: hHeap=0x310000) returned 1 [0145.644] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0145.644] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52611c8 [0145.644] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3eaf18 | out: hHeap=0x310000) returned 1 [0145.644] FindNextFileW (in: hFindFile=0x52611c8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.644] FindNextFileW (in: hFindFile=0x52611c8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0145.644] CreateFileW (lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0145.645] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x501e800 | out: lpFileSize=0x501e800*=11264) returned 1 [0145.645] CloseHandle (hObject=0x4e4) returned 1 [0145.645] FindNextFileW (in: hFindFile=0x52611c8, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0145.645] FindClose (in: hFindFile=0x52611c8 | out: hFindFile=0x52611c8) returned 1 [0145.645] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326770 | out: hHeap=0x310000) returned 1 [0145.645] FindNextFileW (in: hFindFile=0x5260f88, lpFindFileData=0x501ec50 | out: lpFindFileData=0x501ec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0145.645] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5260d08 [0145.646] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39c610 | out: hHeap=0x310000) returned 1 [0145.647] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.647] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0145.728] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261548 [0145.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c920e8 | out: hHeap=0x310000) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0145.729] FindClose (in: hFindFile=0x5261548 | out: hFindFile=0x5261548) returned 1 [0145.729] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5163f70 | out: hHeap=0x310000) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0145.729] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261a88 [0145.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x5261a88, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x5261a88, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x5261a88, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0145.730] FindClose (in: hFindFile=0x5261a88 | out: hFindFile=0x5261a88) returned 1 [0145.730] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5164750 | out: hHeap=0x310000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0145.730] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261548 [0145.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0145.731] FindClose (in: hFindFile=0x5261548 | out: hFindFile=0x5261548) returned 1 [0145.731] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51642f0 | out: hHeap=0x310000) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0145.731] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261788 [0145.732] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0145.732] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.732] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0145.732] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0145.733] FindClose (in: hFindFile=0x5261788 | out: hFindFile=0x5261788) returned 1 [0145.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39bef0 | out: hHeap=0x310000) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0145.734] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261788 [0145.734] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0145.735] FindNextFileW (in: hFindFile=0x5261788, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0145.735] FindClose (in: hFindFile=0x5261788 | out: hFindFile=0x5261788) returned 1 [0145.735] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5164670 | out: hHeap=0x310000) returned 1 [0145.735] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0145.735] FindNextFileW (in: hFindFile=0x5260d08, lpFindFileData=0x501e954 | out: lpFindFileData=0x501e954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0145.735] FindFirstFileW (in: lpFileName="C:\\\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5261548 [0145.736] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c92e08 | out: hHeap=0x310000) returned 1 [0145.736] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.736] FindNextFileW (in: hFindFile=0x5261548, lpFindFileData=0x501e658 | out: lpFindFileData=0x501e658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0154.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f09f0 | out: hHeap=0x310000) returned 1 [0154.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5c39460 | out: hHeap=0x310000) returned 1 [0154.906] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0cc0 | out: hHeap=0x310000) returned 1 [0176.650] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x501e500 | out: lpFileSize=0x501e500*=196) returned 1 [0176.650] CloseHandle (hObject=0x6ac) returned 1 [0176.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x51ceac0 | out: hHeap=0x310000) returned 1 [0176.651] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x520db98) returned 1 [0176.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5215e70 | out: hHeap=0x310000) returned 1 [0176.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321fd8 | out: hHeap=0x310000) returned 1 [0176.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5215850 | out: hHeap=0x310000) returned 1 [0176.651] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x5321820 | out: hHeap=0x310000) returned 1 [0220.744] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x310000) returned 1 [0220.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dc2c8 | out: hHeap=0x310000) returned 1 [0220.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x54006b0 | out: hHeap=0x310000) returned 1 [0220.745] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3dbb98 | out: hHeap=0x310000) returned 1 [0289.131] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x501e200 | out: lpFileSize=0x501e200*=1035) returned 1 [0289.131] CloseHandle (hObject=0x660) returned 1 [0289.131] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3a6738 | out: hHeap=0x310000) returned 1 [0289.131] PostQueuedCompletionStatus (CompletionPort=0x23c, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x1, lpOverlapped=0x603da10) returned 1 [0289.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326a30 | out: hHeap=0x310000) returned 1 [0289.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0180 | out: hHeap=0x310000) returned 1 [0289.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326770 | out: hHeap=0x310000) returned 1 [0289.132] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3f0720 | out: hHeap=0x310000) returned 1 Thread: id = 229 os_tid = 0x710 [0134.199] GetLastError () returned 0x57 [0134.199] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39e288 [0134.200] SetLastError (dwErrCode=0x57) [0134.200] FindFirstFileW (in: lpFileName="Z:\\\\*", lpFindFileData=0x4b1f584 | out: lpFindFileData=0x4b1f584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa936f71c, ftCreationTime.dwHighDateTime=0x1d69a6c, ftLastAccessTime.dwLowDateTime=0xa936f71c, ftLastAccessTime.dwHighDateTime=0x1d69a6c, ftLastWriteTime.dwLowDateTime=0xa936f71c, ftLastWriteTime.dwHighDateTime=0x1d69a6c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$RECYCLE.BIN", cAlternateFileName="")) returned 0x35de48 [0134.200] FindNextFileW (in: hFindFile=0x35de48, lpFindFileData=0x4b1f584 | out: lpFindFileData=0x4b1f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1e3d62eb, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x21f97274, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x21f97274, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0134.963] FindNextFileW (in: hFindFile=0x35de48, lpFindFileData=0x4b1f584 | out: lpFindFileData=0x4b1f584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x8983e192, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x899e1d51, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x899e1d51, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="")) returned 1 [0134.963] FindNextFileW (in: hFindFile=0x35de48, lpFindFileData=0x4b1f584 | out: lpFindFileData=0x4b1f584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x8983e192, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x899e1d51, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x899e1d51, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="")) returned 0 [0134.963] FindClose (in: hFindFile=0x35de48 | out: hFindFile=0x35de48) returned 1 [0134.963] GetCurrentThreadId () returned 0x710 [0134.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x35bd50 | out: hHeap=0x310000) returned 1 [0134.963] GetLastError () returned 0x12 [0134.964] SetLastError (dwErrCode=0x12) [0134.964] FreeLibraryAndExitThread (hLibModule=0x250000, dwExitCode=0x0) [0134.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x396a50 | out: hHeap=0x310000) returned 1 [0134.964] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x39e288 | out: hHeap=0x310000) returned 1 Thread: id = 230 os_tid = 0xec4 Thread: id = 232 os_tid = 0xd94 [0143.562] GetLastError () returned 0x57 [0143.562] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x364) returned 0x39e610 [0143.562] SetLastError (dwErrCode=0x57) [0143.562] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c430 [0143.562] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0143.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0143.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.1", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.1", lpUsedDefaultChar=0x0) returned 11 [0143.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0143.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0143.563] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0143.563] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0143.563] SendARP (in: DestIP=0x100a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x0 [0143.571] NetShareEnum (in: servername="192.168.0.1", level=0x1, bufptr=0x64afc8c, prefmaxlen=0xffffffff, entriesread=0x64afcb0, totalentries=0x64afca8, resume_handle=0x64afcac | out: bufptr=0x64afc8c, entriesread=0x64afcb0, totalentries=0x64afca8, resume_handle=0x64afcac) returned 0x35 [0176.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.1", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.1", cchWideChar=11, lpMultiByteStr=0x64af790, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.1", lpUsedDefaultChar=0x0) returned 11 [0176.390] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0176.390] htons (hostshort=0x6987) returned 0x8769 [0176.390] getnameinfo (in: pSockaddr=0x64af848*(sa_family=2, sin_port=0x6987, sin_addr="192.168.0.1"), SockaddrLength=0x10, pNodeBuffer=0x64af89c, NodeBufferSize=0x401, pServiceBuffer=0x64afca0, ServiceBufferSize=0x20, Flags=8 | out: pNodeBuffer="", pServiceBuffer="") returned 10093 [0176.390] NetDfsEnum () returned 0x57 [0176.391] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0176.391] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3e0 [0176.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.2", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0176.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.2", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.2", lpUsedDefaultChar=0x0) returned 11 [0176.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0176.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0176.391] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0176.391] inet_addr (cp="192.168.0.2") returned 0x200a8c0 [0176.391] SendARP (in: DestIP=0x200a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0179.979] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3e0 | out: hHeap=0x310000) returned 1 [0179.979] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0179.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.3", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0179.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.3", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.3", lpUsedDefaultChar=0x0) returned 11 [0179.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0179.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0179.979] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0179.979] inet_addr (cp="192.168.0.3") returned 0x300a8c0 [0179.979] SendARP (in: DestIP=0x300a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0183.885] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0183.885] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0183.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0183.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.4", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.4", lpUsedDefaultChar=0x0) returned 11 [0183.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0183.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0183.886] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0183.886] inet_addr (cp="192.168.0.4") returned 0x400a8c0 [0183.886] SendARP (in: DestIP=0x400a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0187.338] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0187.338] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0187.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.5", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0187.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.5", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.5", lpUsedDefaultChar=0x0) returned 11 [0187.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0187.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0187.339] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0187.339] inet_addr (cp="192.168.0.5") returned 0x500a8c0 [0187.339] SendARP (in: DestIP=0x500a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0190.802] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0190.802] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0190.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.6", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0190.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.6", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.6", lpUsedDefaultChar=0x0) returned 11 [0190.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0190.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0190.802] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0190.802] inet_addr (cp="192.168.0.6") returned 0x600a8c0 [0190.802] SendARP (in: DestIP=0x600a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0194.750] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0194.750] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0194.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.7", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0194.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.7", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.7", lpUsedDefaultChar=0x0) returned 11 [0194.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0194.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0194.750] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0194.750] inet_addr (cp="192.168.0.7") returned 0x700a8c0 [0194.750] SendARP (in: DestIP=0x700a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0198.400] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0198.400] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0198.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.8", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0198.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.8", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.8", lpUsedDefaultChar=0x0) returned 11 [0198.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0198.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0198.400] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0198.400] inet_addr (cp="192.168.0.8") returned 0x800a8c0 [0198.400] SendARP (in: DestIP=0x800a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0201.119] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0201.119] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0201.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.9", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0201.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.9", cchWideChar=11, lpMultiByteStr=0x64afc30, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.9", lpUsedDefaultChar=0x0) returned 11 [0201.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0201.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0201.120] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0201.120] inet_addr (cp="192.168.0.9") returned 0x900a8c0 [0201.120] SendARP (in: DestIP=0x900a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0204.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0204.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0204.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.10", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0204.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.10", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.10", lpUsedDefaultChar=0x0) returned 12 [0204.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0204.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0204.140] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0204.140] inet_addr (cp="192.168.0.10") returned 0xa00a8c0 [0204.140] SendARP (in: DestIP=0xa00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0207.637] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0207.637] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0207.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.11", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0207.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.11", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.11", lpUsedDefaultChar=0x0) returned 12 [0207.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0207.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0207.638] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0207.638] inet_addr (cp="192.168.0.11") returned 0xb00a8c0 [0207.638] SendARP (in: DestIP=0xb00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0211.298] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0211.298] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0211.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.12", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0211.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.12", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.12", lpUsedDefaultChar=0x0) returned 12 [0211.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0211.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0211.298] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0211.298] inet_addr (cp="192.168.0.12") returned 0xc00a8c0 [0211.298] SendARP (in: DestIP=0xc00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0214.634] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0214.634] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0214.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.13", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0214.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.13", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.13", lpUsedDefaultChar=0x0) returned 12 [0214.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0214.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0214.634] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0214.634] inet_addr (cp="192.168.0.13") returned 0xd00a8c0 [0214.634] SendARP (in: DestIP=0xd00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0217.455] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0217.455] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0217.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.14", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0217.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.14", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.14", lpUsedDefaultChar=0x0) returned 12 [0217.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0217.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0217.455] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0217.455] inet_addr (cp="192.168.0.14") returned 0xe00a8c0 [0217.455] SendARP (in: DestIP=0xe00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0221.057] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0221.057] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0221.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.15", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0221.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.15", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.15", lpUsedDefaultChar=0x0) returned 12 [0221.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0221.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0221.057] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0221.057] inet_addr (cp="192.168.0.15") returned 0xf00a8c0 [0221.057] SendARP (in: DestIP=0xf00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0224.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0224.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0224.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.16", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0224.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.16", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.16", lpUsedDefaultChar=0x0) returned 12 [0224.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0224.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0224.002] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0224.002] inet_addr (cp="192.168.0.16") returned 0x1000a8c0 [0224.002] SendARP (in: DestIP=0x1000a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0229.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0229.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c548 [0229.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.17", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0229.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.17", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.17", lpUsedDefaultChar=0x0) returned 12 [0229.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0229.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0229.056] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0229.056] inet_addr (cp="192.168.0.17") returned 0x1100a8c0 [0229.056] SendARP (in: DestIP=0x1100a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0232.528] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c548 | out: hHeap=0x310000) returned 1 [0232.528] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0232.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.18", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0232.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.18", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.18", lpUsedDefaultChar=0x0) returned 12 [0232.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0232.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0232.528] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0232.528] inet_addr (cp="192.168.0.18") returned 0x1200a8c0 [0232.528] SendARP (in: DestIP=0x1200a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0236.137] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0236.137] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c520 [0236.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.19", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0236.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.19", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.19", lpUsedDefaultChar=0x0) returned 12 [0236.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0236.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0236.137] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0236.137] inet_addr (cp="192.168.0.19") returned 0x1300a8c0 [0236.137] SendARP (in: DestIP=0x1300a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0239.140] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c520 | out: hHeap=0x310000) returned 1 [0239.140] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0239.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.20", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0239.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.20", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.20", lpUsedDefaultChar=0x0) returned 12 [0239.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0239.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0239.140] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0239.140] inet_addr (cp="192.168.0.20") returned 0x1400a8c0 [0239.140] SendARP (in: DestIP=0x1400a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0242.752] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0242.753] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0242.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.21", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0242.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.21", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.21", lpUsedDefaultChar=0x0) returned 12 [0242.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0242.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0242.753] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0242.753] inet_addr (cp="192.168.0.21") returned 0x1500a8c0 [0242.753] SendARP (in: DestIP=0x1500a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0246.353] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0246.354] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0246.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.22", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0246.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.22", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.22", lpUsedDefaultChar=0x0) returned 12 [0246.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0246.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0246.354] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0246.354] inet_addr (cp="192.168.0.22") returned 0x1600a8c0 [0246.354] SendARP (DestIP=0x1600a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) [0249.823] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c070 | out: hHeap=0x310000) returned 1 [0249.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0249.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.23", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0249.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.23", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.23", lpUsedDefaultChar=0x0) returned 12 [0249.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0249.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0249.823] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0249.823] inet_addr (cp="192.168.0.23") returned 0x1700a8c0 [0249.823] SendARP (in: DestIP=0x1700a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0253.588] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0253.588] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0253.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.24", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0253.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.24", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.24", lpUsedDefaultChar=0x0) returned 12 [0253.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0253.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0253.589] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0253.589] inet_addr (cp="192.168.0.24") returned 0x1800a8c0 [0253.589] SendARP (in: DestIP=0x1800a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0257.742] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0257.742] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c480 [0257.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.25", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0257.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.25", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.25", lpUsedDefaultChar=0x0) returned 12 [0257.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0257.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0257.742] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0257.742] inet_addr (cp="192.168.0.25") returned 0x1900a8c0 [0257.742] SendARP (in: DestIP=0x1900a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0261.522] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c480 | out: hHeap=0x310000) returned 1 [0261.522] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c3b8 [0261.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.26", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0261.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.26", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.26", lpUsedDefaultChar=0x0) returned 12 [0261.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0261.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0261.522] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0261.522] inet_addr (cp="192.168.0.26") returned 0x1a00a8c0 [0261.522] SendARP (in: DestIP=0x1a00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0265.243] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c3b8 | out: hHeap=0x310000) returned 1 [0265.243] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c4d0 [0265.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.27", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0265.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.27", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.27", lpUsedDefaultChar=0x0) returned 12 [0265.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0265.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0265.243] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0265.243] inet_addr (cp="192.168.0.27") returned 0x1b00a8c0 [0265.244] SendARP (in: DestIP=0x1b00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0268.741] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c4d0 | out: hHeap=0x310000) returned 1 [0268.741] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c0c0 [0268.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.28", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0268.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.28", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.28", lpUsedDefaultChar=0x0) returned 12 [0268.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0268.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0268.741] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0268.741] inet_addr (cp="192.168.0.28") returned 0x1c00a8c0 [0268.741] SendARP (in: DestIP=0x1c00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0271.531] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c0c0 | out: hHeap=0x310000) returned 1 [0271.531] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0271.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.29", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0271.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.29", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.29", lpUsedDefaultChar=0x0) returned 12 [0271.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0271.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0271.531] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0271.531] inet_addr (cp="192.168.0.29") returned 0x1d00a8c0 [0271.531] SendARP (in: DestIP=0x1d00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0274.894] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0274.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c098 [0274.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.30", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0274.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.30", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.30", lpUsedDefaultChar=0x0) returned 12 [0274.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0274.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0274.894] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0274.894] inet_addr (cp="192.168.0.30") returned 0x1e00a8c0 [0274.894] SendARP (in: DestIP=0x1e00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0278.517] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c098 | out: hHeap=0x310000) returned 1 [0278.517] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0278.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.31", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0278.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.31", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.31", lpUsedDefaultChar=0x0) returned 12 [0278.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0278.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0278.517] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0278.517] inet_addr (cp="192.168.0.31") returned 0x1f00a8c0 [0278.517] SendARP (in: DestIP=0x1f00a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0282.111] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0282.111] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c188 [0282.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.32", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0282.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.32", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.32", lpUsedDefaultChar=0x0) returned 12 [0282.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0282.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0282.111] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0282.111] inet_addr (cp="192.168.0.32") returned 0x2000a8c0 [0282.112] SendARP (in: DestIP=0x2000a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0285.127] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c188 | out: hHeap=0x310000) returned 1 [0285.127] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0285.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.33", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0285.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.33", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.33", lpUsedDefaultChar=0x0) returned 12 [0285.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0285.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0285.127] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0285.127] inet_addr (cp="192.168.0.33") returned 0x2100a8c0 [0285.127] SendARP (in: DestIP=0x2100a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0288.370] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0288.370] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c390 [0288.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.34", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0288.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.34", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.34", lpUsedDefaultChar=0x0) returned 12 [0288.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0288.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0288.370] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0288.370] inet_addr (cp="192.168.0.34") returned 0x2200a8c0 [0288.370] SendARP (in: DestIP=0x2200a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0291.189] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x310000) returned 1 [0291.189] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0291.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.35", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0291.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.35", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.35", lpUsedDefaultChar=0x0) returned 12 [0291.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0291.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0291.189] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0291.189] inet_addr (cp="192.168.0.35") returned 0x2300a8c0 [0291.189] SendARP (in: DestIP=0x2300a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0294.971] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0294.971] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c160 [0294.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.36", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0294.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.36", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.36", lpUsedDefaultChar=0x0) returned 12 [0294.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0294.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0294.972] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0294.972] inet_addr (cp="192.168.0.36") returned 0x2400a8c0 [0294.972] SendARP (in: DestIP=0x2400a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c | out: pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) returned 0x43 [0298.172] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x38c160 | out: hHeap=0x310000) returned 1 [0298.172] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20) returned 0x38c070 [0298.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.37", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0298.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.37", cchWideChar=12, lpMultiByteStr=0x64afc30, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.37", lpUsedDefaultChar=0x0) returned 12 [0298.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0298.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="192.168.0.241", cchWideChar=13, lpMultiByteStr=0x64afc30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="192.168.0.241", lpUsedDefaultChar=0x0) returned 13 [0298.173] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0298.173] inet_addr (cp="192.168.0.37") returned 0x2500a8c0 [0298.173] SendARP (DestIP=0x2500a8c0, SrcIP=0xf100a8c0, pMacAddr=0x64afcb8, PhyAddrLen=0x64afc9c) Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x742fe000" os_pid = "0x3ac" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "created_scheduled_job" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 19 os_tid = 0x12cc Thread: id = 20 os_tid = 0x12c8 Thread: id = 21 os_tid = 0x12c4 Thread: id = 22 os_tid = 0x12c0 Thread: id = 23 os_tid = 0x12bc Thread: id = 24 os_tid = 0x12b8 Thread: id = 25 os_tid = 0x12b4 Thread: id = 26 os_tid = 0x1270 Thread: id = 27 os_tid = 0x128c Thread: id = 28 os_tid = 0x1280 Thread: id = 29 os_tid = 0x127c Thread: id = 30 os_tid = 0x1278 Thread: id = 31 os_tid = 0x1268 Thread: id = 32 os_tid = 0x11f8 Thread: id = 33 os_tid = 0x11ac Thread: id = 34 os_tid = 0x11a8 Thread: id = 35 os_tid = 0x11a4 Thread: id = 36 os_tid = 0x10a4 Thread: id = 37 os_tid = 0x10a0 Thread: id = 38 os_tid = 0x109c Thread: id = 39 os_tid = 0x1090 Thread: id = 40 os_tid = 0x106c Thread: id = 41 os_tid = 0x1078 Thread: id = 42 os_tid = 0x1074 Thread: id = 43 os_tid = 0x1020 Thread: id = 44 os_tid = 0x101c Thread: id = 45 os_tid = 0x1018 Thread: id = 46 os_tid = 0x1014 Thread: id = 47 os_tid = 0x100c Thread: id = 48 os_tid = 0x1008 Thread: id = 49 os_tid = 0x1004 Thread: id = 50 os_tid = 0xfac Thread: id = 51 os_tid = 0xaa0 Thread: id = 52 os_tid = 0xa30 Thread: id = 53 os_tid = 0xa14 Thread: id = 54 os_tid = 0xa0c Thread: id = 55 os_tid = 0x9e8 Thread: id = 56 os_tid = 0x9e0 Thread: id = 57 os_tid = 0x9d8 Thread: id = 58 os_tid = 0x9cc Thread: id = 59 os_tid = 0x9c4 Thread: id = 60 os_tid = 0x9b8 Thread: id = 61 os_tid = 0x9b0 Thread: id = 62 os_tid = 0x9a0 Thread: id = 63 os_tid = 0x998 Thread: id = 64 os_tid = 0x984 Thread: id = 65 os_tid = 0x978 Thread: id = 66 os_tid = 0x968 Thread: id = 67 os_tid = 0x95c Thread: id = 68 os_tid = 0x958 Thread: id = 69 os_tid = 0x944 Thread: id = 70 os_tid = 0x930 Thread: id = 71 os_tid = 0x914 Thread: id = 72 os_tid = 0x8ac Thread: id = 73 os_tid = 0x840 Thread: id = 74 os_tid = 0x83c Thread: id = 75 os_tid = 0x430 Thread: id = 76 os_tid = 0x7c0 Thread: id = 77 os_tid = 0x7bc Thread: id = 78 os_tid = 0x7ac Thread: id = 79 os_tid = 0x784 Thread: id = 80 os_tid = 0x780 Thread: id = 81 os_tid = 0x77c Thread: id = 82 os_tid = 0x6fc Thread: id = 83 os_tid = 0x678 Thread: id = 84 os_tid = 0x670 Thread: id = 85 os_tid = 0x660 Thread: id = 86 os_tid = 0x654 Thread: id = 87 os_tid = 0x61c Thread: id = 88 os_tid = 0x5d0 Thread: id = 89 os_tid = 0x5a0 Thread: id = 90 os_tid = 0x4ac Thread: id = 91 os_tid = 0x41c Thread: id = 92 os_tid = 0x414 Thread: id = 93 os_tid = 0x404 Thread: id = 94 os_tid = 0x158 Thread: id = 95 os_tid = 0x39c Thread: id = 96 os_tid = 0x2e8 Thread: id = 97 os_tid = 0x180 Thread: id = 98 os_tid = 0x234 Thread: id = 99 os_tid = 0x26c Thread: id = 100 os_tid = 0x2a0 Thread: id = 101 os_tid = 0x170 Thread: id = 102 os_tid = 0x1a8 Thread: id = 103 os_tid = 0x16c Thread: id = 104 os_tid = 0x3b0 Thread: id = 106 os_tid = 0x13e4 Thread: id = 110 os_tid = 0x1140 Thread: id = 111 os_tid = 0x1150 Thread: id = 114 os_tid = 0xeb4 Thread: id = 116 os_tid = 0x10ac Thread: id = 129 os_tid = 0x4b4 Thread: id = 130 os_tid = 0xe98 Thread: id = 131 os_tid = 0x123c Thread: id = 135 os_tid = 0x53c Thread: id = 168 os_tid = 0xcf8 Thread: id = 172 os_tid = 0xd48 Thread: id = 173 os_tid = 0xf84 Thread: id = 174 os_tid = 0xf74 Thread: id = 175 os_tid = 0xf94 Thread: id = 176 os_tid = 0x1250 Thread: id = 177 os_tid = 0x12e4 Thread: id = 178 os_tid = 0xf68 Thread: id = 179 os_tid = 0xf7c Thread: id = 180 os_tid = 0x1348 Thread: id = 181 os_tid = 0x1350 Thread: id = 182 os_tid = 0x1360 Thread: id = 183 os_tid = 0x1330 Thread: id = 184 os_tid = 0x13a4 Thread: id = 185 os_tid = 0x1304 Thread: id = 186 os_tid = 0x1310 Thread: id = 187 os_tid = 0x1318 Thread: id = 188 os_tid = 0x1314 Thread: id = 189 os_tid = 0x130c Thread: id = 190 os_tid = 0x1328 Thread: id = 196 os_tid = 0x10b0 Thread: id = 200 os_tid = 0x1390 Thread: id = 201 os_tid = 0x1388 Thread: id = 202 os_tid = 0x13c4 Thread: id = 203 os_tid = 0x13c0 Thread: id = 231 os_tid = 0xf24 Thread: id = 233 os_tid = 0x1144 Thread: id = 243 os_tid = 0x1234 Thread: id = 244 os_tid = 0x11d4 Thread: id = 245 os_tid = 0x12a8 Thread: id = 246 os_tid = 0x10cc Thread: id = 247 os_tid = 0x1154 Thread: id = 248 os_tid = 0x119c Thread: id = 249 os_tid = 0xf40 Thread: id = 641 os_tid = 0x6d8 Thread: id = 652 os_tid = 0x9c0 Process: id = "3" image_name = "buiransomsample.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\buiransomsample.exe" page_root = "0x6778f000" os_pid = "0x10e0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\BUIRansomSample.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 105 os_tid = 0x10ec Process: id = "4" image_name = "buiransomsample.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\buiransomsample.exe" page_root = "0x17f90000" os_pid = "0xe70" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\BUIRansomSample.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 107 os_tid = 0x10dc Process: id = "5" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x17b95000" os_pid = "0x10cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "wmic.exe SHADOWCOPY /nointeractive" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0x113c [0084.081] GetModuleHandleA (lpModuleName=0x0) returned 0x940000 [0084.081] __set_app_type (_Type=0x1) [0084.081] __p__fmode () returned 0x776f3c14 [0084.081] __p__commode () returned 0x776f49ec [0084.082] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x979af0) returned 0x0 [0084.082] __wgetmainargs (in: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0, _DoWildCard=0, _StartInfo=0x9881bc | out: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0) returned 0 [0084.082] ??0CHString@@QAE@XZ () returned 0x9885ec [0084.082] malloc (_Size=0x18) returned 0x2ef0ed8 [0084.083] malloc (_Size=0x38) returned 0x2ef0ef8 [0084.083] malloc (_Size=0x28) returned 0x2ef0f38 [0084.083] malloc (_Size=0x18) returned 0x2ef0f68 [0084.083] malloc (_Size=0x24) returned 0x2ef0f88 [0084.083] malloc (_Size=0x18) returned 0x2ef0fb8 [0084.083] malloc (_Size=0x18) returned 0x2ef0fd8 [0084.083] ??0CHString@@QAE@XZ () returned 0x9888fc [0084.083] malloc (_Size=0x18) returned 0x2ef0ff8 [0084.083] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0084.083] SetConsoleCtrlHandler (HandlerRoutine=0x973cc0, Add=1) returned 1 [0084.083] _onexit (_Func=0x97f370) returned 0x97f370 [0084.083] _onexit (_Func=0x97f380) returned 0x97f380 [0084.083] _onexit (_Func=0x97f390) returned 0x97f390 [0084.084] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0084.084] ResolveDelayLoadedAPI () returned 0x74a22590 [0084.084] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0084.090] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0085.953] CoCreateInstance (in: rclsid=0x946a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x988510 | out: ppv=0x988510*=0x2cc4640) returned 0x0 [0087.059] GetCurrentProcess () returned 0xffffffff [0087.059] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x82f72c | out: TokenHandle=0x82f72c*=0x1a0) returned 1 [0087.059] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x82f728 | out: TokenInformation=0x0, ReturnLength=0x82f728) returned 0 [0087.059] malloc (_Size=0x118) returned 0x2ef2598 [0087.059] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x2ef2598, TokenInformationLength=0x118, ReturnLength=0x82f728 | out: TokenInformation=0x2ef2598, ReturnLength=0x82f728) returned 1 [0087.059] AdjustTokenPrivileges (in: TokenHandle=0x1a0, DisableAllPrivileges=0, NewState=0x2ef2598*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0087.059] free (_Block=0x2ef2598) [0087.059] CloseHandle (hObject=0x1a0) returned 1 [0087.060] malloc (_Size=0x40) returned 0x2ef2598 [0087.060] malloc (_Size=0x40) returned 0x2ef25e0 [0087.060] malloc (_Size=0x40) returned 0x2ef2628 [0087.060] SetThreadUILanguage (LangId=0x0) returned 0x2be0409 [0087.132] _vsnwprintf (in: _Buffer=0x2ef2628, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x82f6b4 | out: _Buffer="ms_409") returned 6 [0087.132] malloc (_Size=0x20) returned 0x2ef2670 [0087.132] GetComputerNameW (in: lpBuffer=0x2ef2670, nSize=0x82f718 | out: lpBuffer="NQDPDE", nSize=0x82f718) returned 1 [0087.133] lstrlenW (lpString="NQDPDE") returned 6 [0087.133] malloc (_Size=0xe) returned 0x2ef11a8 [0087.133] lstrlenW (lpString="NQDPDE") returned 6 [0087.133] ResolveDelayLoadedAPI () returned 0x7444db00 [0087.133] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x82f72c | out: lpNameBuffer=0x0, nSize=0x82f72c) returned 0x2be2000 [0087.135] GetLastError () returned 0xea [0087.135] malloc (_Size=0x1e) returned 0x2ef2698 [0087.135] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2ef2698, nSize=0x82f72c | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x82f72c) returned 0x1 [0087.136] lstrlenW (lpString="") returned 0 [0087.136] lstrlenW (lpString="NQDPDE") returned 6 [0087.136] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0087.139] lstrlenW (lpString=".") returned 1 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0087.139] lstrlenW (lpString="LOCALHOST") returned 9 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0087.139] free (_Block=0x2ef11a8) [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] malloc (_Size=0xe) returned 0x2ef11a8 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.139] malloc (_Size=0xe) returned 0x2ef26c0 [0087.139] lstrlenW (lpString="NQDPDE") returned 6 [0087.140] malloc (_Size=0x4) returned 0x2ef26d8 [0087.140] malloc (_Size=0xc) returned 0x2ef26e8 [0087.140] ResolveDelayLoadedAPI () returned 0x7745b870 [0087.207] malloc (_Size=0x18) returned 0x2ef2700 [0087.207] malloc (_Size=0xc) returned 0x2ef2720 [0087.207] SysStringLen (param_1="IDENTIFY") returned 0x8 [0087.207] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0087.207] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0087.207] SysStringLen (param_1="IDENTIFY") returned 0x8 [0087.207] malloc (_Size=0x18) returned 0x2ef2738 [0087.207] malloc (_Size=0xc) returned 0x2ef2758 [0087.207] SysStringLen (param_1="IMPERSONATE") returned 0xb [0087.207] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0087.207] SysStringLen (param_1="IMPERSONATE") returned 0xb [0087.207] SysStringLen (param_1="IDENTIFY") returned 0x8 [0087.207] SysStringLen (param_1="IDENTIFY") returned 0x8 [0087.207] SysStringLen (param_1="IMPERSONATE") returned 0xb [0087.207] malloc (_Size=0x18) returned 0x2ef2770 [0087.207] malloc (_Size=0xc) returned 0x2ef2790 [0087.207] SysStringLen (param_1="DELEGATE") returned 0x8 [0087.208] SysStringLen (param_1="IDENTIFY") returned 0x8 [0087.208] SysStringLen (param_1="DELEGATE") returned 0x8 [0087.208] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0087.208] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0087.208] SysStringLen (param_1="DELEGATE") returned 0x8 [0087.208] malloc (_Size=0x18) returned 0x2ef27a8 [0087.208] malloc (_Size=0xc) returned 0x2ef27c8 [0087.208] malloc (_Size=0x18) returned 0x2ef27e0 [0087.208] malloc (_Size=0xc) returned 0x2ef2800 [0087.208] SysStringLen (param_1="NONE") returned 0x4 [0087.208] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.208] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.208] SysStringLen (param_1="NONE") returned 0x4 [0087.208] malloc (_Size=0x18) returned 0x2ef2818 [0087.208] malloc (_Size=0xc) returned 0x2ef2838 [0087.208] SysStringLen (param_1="CONNECT") returned 0x7 [0087.208] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.208] malloc (_Size=0x18) returned 0x2ef2850 [0087.208] malloc (_Size=0xc) returned 0x2ef04a0 [0087.210] SysStringLen (param_1="CALL") returned 0x4 [0087.210] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.210] SysStringLen (param_1="CALL") returned 0x4 [0087.210] SysStringLen (param_1="CONNECT") returned 0x7 [0087.210] malloc (_Size=0x18) returned 0x2ef04b8 [0087.210] malloc (_Size=0xc) returned 0x2ef04d8 [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] SysStringLen (param_1="NONE") returned 0x4 [0087.211] SysStringLen (param_1="NONE") returned 0x4 [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] malloc (_Size=0x18) returned 0x2ef2bd8 [0087.211] malloc (_Size=0xc) returned 0x2ef2c78 [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] SysStringLen (param_1="NONE") returned 0x4 [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] malloc (_Size=0x18) returned 0x2ef2b78 [0087.211] malloc (_Size=0xc) returned 0x2ef2c90 [0087.211] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0087.211] SysStringLen (param_1="DEFAULT") returned 0x7 [0087.211] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0087.211] SysStringLen (param_1="PKT") returned 0x3 [0087.211] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0087.211] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0087.212] malloc (_Size=0x18) returned 0x2ef2b98 [0087.212] malloc (_Size=0x40) returned 0x2ef04f0 [0087.212] malloc (_Size=0x20a) returned 0x2ef94c8 [0087.212] GetSystemDirectoryW (in: lpBuffer=0x2ef94c8, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0087.212] free (_Block=0x2ef94c8) [0087.212] malloc (_Size=0xc) returned 0x2ef2ca8 [0087.212] malloc (_Size=0xc) returned 0x2ef0538 [0087.212] malloc (_Size=0xc) returned 0x2ef0550 [0087.212] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0087.212] SysStringLen (param_1="\\wbem\\") returned 0x6 [0087.212] free (_Block=0x2ef2ca8) [0087.212] free (_Block=0x2ef0538) [0087.212] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0087.213] free (_Block=0x2ef0550) [0087.213] malloc (_Size=0xc) returned 0x2ef9580 [0087.213] malloc (_Size=0xc) returned 0x2ef94f0 [0087.213] malloc (_Size=0xc) returned 0x2ef9550 [0087.213] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0087.213] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0087.213] free (_Block=0x2ef9580) [0087.213] free (_Block=0x2ef94f0) [0087.213] GetCurrentThreadId () returned 0x113c [0087.213] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x82f23c | out: phkResult=0x82f23c*=0x1ac) returned 0x0 [0087.213] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x82f248, lpcbData=0x82f244*=0x400 | out: lpType=0x0, lpData=0x82f248*=0x30, lpcbData=0x82f244*=0x4) returned 0x0 [0087.213] _wcsicmp (_String1="0", _String2="1") returned -1 [0087.214] _wcsicmp (_String1="0", _String2="2") returned -2 [0087.214] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x82f244*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x82f244*=0x42) returned 0x0 [0087.214] malloc (_Size=0x86) returned 0x2ef96d0 [0087.214] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2ef96d0, lpcbData=0x82f244*=0x42 | out: lpType=0x0, lpData=0x2ef96d0*=0x25, lpcbData=0x82f244*=0x42) returned 0x0 [0087.214] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0087.214] malloc (_Size=0x42) returned 0x2ef0538 [0087.214] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0087.214] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x82f248, lpcbData=0x82f244*=0x400 | out: lpType=0x0, lpData=0x82f248*=0x36, lpcbData=0x82f244*=0xc) returned 0x0 [0087.214] _wtol (_String="65536") returned 65536 [0087.214] free (_Block=0x2ef96d0) [0087.214] RegCloseKey (hKey=0x0) returned 0x6 [0087.214] CoCreateInstance (in: rclsid=0x946ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x82f6d8 | out: ppv=0x82f6d8*=0x33a45a8) returned 0x0 [0087.586] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x33a45a8, xmlSource=0x82f65c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x82f6c4 | out: isSuccessful=0x82f6c4*=0xffff) returned 0x0 [0090.445] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x33a45a8, DOMElement=0x82f6d4 | out: DOMElement=0x82f6d4) returned 0x0 [0090.445] malloc (_Size=0xc) returned 0x2ef9520 [0090.446] free (_Block=0x2ef9520) [0090.447] malloc (_Size=0xc) returned 0x2ef9598 [0090.447] free (_Block=0x2ef9598) [0090.447] malloc (_Size=0xc) returned 0x2ef9508 [0090.447] malloc (_Size=0xc) returned 0x2ef9598 [0090.447] malloc (_Size=0x18) returned 0x2ef2bb8 [0090.448] malloc (_Size=0xc) returned 0x2ef95f8 [0090.448] free (_Block=0x2ef95f8) [0090.448] malloc (_Size=0xc) returned 0x2ef9580 [0090.448] malloc (_Size=0xc) returned 0x2ef9520 [0090.448] SysStringLen (param_1="VALUE") returned 0x5 [0090.448] SysStringLen (param_1="TABLE") returned 0x5 [0090.448] SysStringLen (param_1="TABLE") returned 0x5 [0090.448] SysStringLen (param_1="VALUE") returned 0x5 [0090.448] malloc (_Size=0x18) returned 0x2ef2a98 [0090.449] malloc (_Size=0xc) returned 0x2ef9688 [0090.449] free (_Block=0x2ef9688) [0090.449] malloc (_Size=0xc) returned 0x2ef9640 [0090.449] malloc (_Size=0xc) returned 0x2ef95f8 [0090.449] SysStringLen (param_1="LIST") returned 0x4 [0090.449] SysStringLen (param_1="TABLE") returned 0x5 [0090.449] malloc (_Size=0x18) returned 0x2ef2c58 [0090.450] malloc (_Size=0xc) returned 0x2ef9568 [0090.450] free (_Block=0x2ef9568) [0090.450] malloc (_Size=0xc) returned 0x2ef9610 [0090.450] malloc (_Size=0xc) returned 0x2ef9688 [0090.450] SysStringLen (param_1="RAWXML") returned 0x6 [0090.450] SysStringLen (param_1="TABLE") returned 0x5 [0090.450] SysStringLen (param_1="RAWXML") returned 0x6 [0090.450] SysStringLen (param_1="LIST") returned 0x4 [0090.450] SysStringLen (param_1="LIST") returned 0x4 [0090.450] SysStringLen (param_1="RAWXML") returned 0x6 [0090.450] malloc (_Size=0x18) returned 0x2ef2b58 [0090.451] malloc (_Size=0xc) returned 0x2ef9538 [0090.451] free (_Block=0x2ef9538) [0090.451] malloc (_Size=0xc) returned 0x2ef9628 [0090.451] malloc (_Size=0xc) returned 0x2ef9568 [0090.451] SysStringLen (param_1="HTABLE") returned 0x6 [0090.451] SysStringLen (param_1="TABLE") returned 0x5 [0090.451] SysStringLen (param_1="HTABLE") returned 0x6 [0090.451] SysStringLen (param_1="LIST") returned 0x4 [0090.451] malloc (_Size=0x18) returned 0x2ef2a78 [0090.452] malloc (_Size=0xc) returned 0x2ef94f0 [0090.452] free (_Block=0x2ef94f0) [0090.452] malloc (_Size=0xc) returned 0x2ef9658 [0090.452] malloc (_Size=0xc) returned 0x2ef96a0 [0090.452] SysStringLen (param_1="HFORM") returned 0x5 [0090.452] SysStringLen (param_1="TABLE") returned 0x5 [0090.452] SysStringLen (param_1="HFORM") returned 0x5 [0090.452] SysStringLen (param_1="LIST") returned 0x4 [0090.452] SysStringLen (param_1="HFORM") returned 0x5 [0090.452] SysStringLen (param_1="HTABLE") returned 0x6 [0090.452] malloc (_Size=0x18) returned 0x2ef29d8 [0090.453] malloc (_Size=0xc) returned 0x2ef95e0 [0090.453] free (_Block=0x2ef95e0) [0090.453] malloc (_Size=0xc) returned 0x2ef95c8 [0090.453] malloc (_Size=0xc) returned 0x2ef95e0 [0090.453] SysStringLen (param_1="XML") returned 0x3 [0090.453] SysStringLen (param_1="TABLE") returned 0x5 [0090.453] SysStringLen (param_1="XML") returned 0x3 [0090.453] SysStringLen (param_1="VALUE") returned 0x5 [0090.453] SysStringLen (param_1="VALUE") returned 0x5 [0090.453] SysStringLen (param_1="XML") returned 0x3 [0090.453] malloc (_Size=0x18) returned 0x2ef2898 [0090.454] malloc (_Size=0xc) returned 0x2ef95b0 [0090.454] free (_Block=0x2ef95b0) [0090.454] malloc (_Size=0xc) returned 0x2ef96b8 [0090.454] malloc (_Size=0xc) returned 0x2ef9670 [0090.454] SysStringLen (param_1="MOF") returned 0x3 [0090.454] SysStringLen (param_1="TABLE") returned 0x5 [0090.454] SysStringLen (param_1="MOF") returned 0x3 [0090.454] SysStringLen (param_1="LIST") returned 0x4 [0090.454] SysStringLen (param_1="MOF") returned 0x3 [0090.454] SysStringLen (param_1="RAWXML") returned 0x6 [0090.454] SysStringLen (param_1="LIST") returned 0x4 [0090.454] SysStringLen (param_1="MOF") returned 0x3 [0090.455] malloc (_Size=0x18) returned 0x2ef29f8 [0090.455] malloc (_Size=0xc) returned 0x2ef94f0 [0090.455] free (_Block=0x2ef94f0) [0090.455] malloc (_Size=0xc) returned 0x2ef95b0 [0090.455] malloc (_Size=0xc) returned 0x2ef94f0 [0090.455] SysStringLen (param_1="CSV") returned 0x3 [0090.455] SysStringLen (param_1="TABLE") returned 0x5 [0090.455] SysStringLen (param_1="CSV") returned 0x3 [0090.455] SysStringLen (param_1="LIST") returned 0x4 [0090.455] SysStringLen (param_1="CSV") returned 0x3 [0090.455] SysStringLen (param_1="HTABLE") returned 0x6 [0090.456] SysStringLen (param_1="CSV") returned 0x3 [0090.456] SysStringLen (param_1="HFORM") returned 0x5 [0090.456] malloc (_Size=0x18) returned 0x2ef29b8 [0090.456] malloc (_Size=0xc) returned 0x2ef9538 [0090.456] free (_Block=0x2ef9538) [0090.456] malloc (_Size=0xc) returned 0x2ef9538 [0090.456] malloc (_Size=0xc) returned 0x2efa920 [0090.456] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.456] SysStringLen (param_1="TABLE") returned 0x5 [0090.456] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.456] SysStringLen (param_1="VALUE") returned 0x5 [0090.456] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.457] SysStringLen (param_1="XML") returned 0x3 [0090.457] SysStringLen (param_1="XML") returned 0x3 [0090.457] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.457] malloc (_Size=0x18) returned 0x2ef2bf8 [0090.457] malloc (_Size=0xc) returned 0x2efab30 [0090.457] free (_Block=0x2efab30) [0090.457] malloc (_Size=0xc) returned 0x2efa950 [0090.457] malloc (_Size=0xc) returned 0x2efaa70 [0090.457] SysStringLen (param_1="texttablewsys") returned 0xd [0090.457] SysStringLen (param_1="TABLE") returned 0x5 [0090.457] SysStringLen (param_1="texttablewsys") returned 0xd [0090.457] SysStringLen (param_1="XML") returned 0x3 [0090.457] SysStringLen (param_1="texttablewsys") returned 0xd [0090.457] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.457] SysStringLen (param_1="XML") returned 0x3 [0090.457] SysStringLen (param_1="texttablewsys") returned 0xd [0090.458] malloc (_Size=0x18) returned 0x2ef2938 [0090.458] malloc (_Size=0xc) returned 0x2efab90 [0090.458] free (_Block=0x2efab90) [0090.458] malloc (_Size=0xc) returned 0x2efaad0 [0090.458] malloc (_Size=0xc) returned 0x2efaae8 [0090.458] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.458] SysStringLen (param_1="TABLE") returned 0x5 [0090.458] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.458] SysStringLen (param_1="XML") returned 0x3 [0090.458] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.459] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.459] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.459] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.459] malloc (_Size=0x18) returned 0x2ef2c18 [0090.459] malloc (_Size=0xc) returned 0x2efab00 [0090.459] free (_Block=0x2efab00) [0090.459] malloc (_Size=0xc) returned 0x2efa8f0 [0090.459] malloc (_Size=0xc) returned 0x2efab48 [0090.459] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.459] SysStringLen (param_1="TABLE") returned 0x5 [0090.459] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.460] SysStringLen (param_1="XML") returned 0x3 [0090.460] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.460] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.460] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.460] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.460] malloc (_Size=0x18) returned 0x2ef2998 [0090.460] malloc (_Size=0xc) returned 0x2efab00 [0090.460] free (_Block=0x2efab00) [0090.460] malloc (_Size=0xc) returned 0x2efabc0 [0090.460] malloc (_Size=0xc) returned 0x2efaa28 [0090.461] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.461] SysStringLen (param_1="TABLE") returned 0x5 [0090.461] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.461] SysStringLen (param_1="XML") returned 0x3 [0090.461] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.461] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.461] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.461] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.461] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.461] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.461] malloc (_Size=0x18) returned 0x2ef28b8 [0090.461] malloc (_Size=0xc) returned 0x2efab00 [0090.461] free (_Block=0x2efab00) [0090.462] malloc (_Size=0xc) returned 0x2efaa40 [0090.462] malloc (_Size=0xc) returned 0x2efab00 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] SysStringLen (param_1="TABLE") returned 0x5 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] SysStringLen (param_1="XML") returned 0x3 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.462] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.462] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0090.462] malloc (_Size=0x18) returned 0x2ef2a18 [0090.462] malloc (_Size=0xc) returned 0x2efab18 [0090.463] free (_Block=0x2efab18) [0090.463] malloc (_Size=0xc) returned 0x2efa998 [0090.463] malloc (_Size=0xc) returned 0x2efaa88 [0090.463] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.463] SysStringLen (param_1="TABLE") returned 0x5 [0090.463] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.463] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.463] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.489] SysStringLen (param_1="XML") returned 0x3 [0090.489] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.489] SysStringLen (param_1="texttablewsys") returned 0xd [0090.489] SysStringLen (param_1="XML") returned 0x3 [0090.489] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.489] malloc (_Size=0x18) returned 0x2ef2b18 [0090.490] malloc (_Size=0xc) returned 0x2efaa58 [0090.490] free (_Block=0x2efaa58) [0090.490] malloc (_Size=0xc) returned 0x2efaab8 [0090.490] malloc (_Size=0xc) returned 0x2efab18 [0090.490] SysStringLen (param_1="htable-sortby") returned 0xd [0090.490] SysStringLen (param_1="TABLE") returned 0x5 [0090.490] SysStringLen (param_1="htable-sortby") returned 0xd [0090.490] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.490] SysStringLen (param_1="htable-sortby") returned 0xd [0090.490] SysStringLen (param_1="XML") returned 0x3 [0090.490] SysStringLen (param_1="htable-sortby") returned 0xd [0090.491] SysStringLen (param_1="texttablewsys") returned 0xd [0090.491] SysStringLen (param_1="htable-sortby") returned 0xd [0090.491] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0090.491] SysStringLen (param_1="XML") returned 0x3 [0090.491] SysStringLen (param_1="htable-sortby") returned 0xd [0090.491] malloc (_Size=0x18) returned 0x2ef2958 [0090.491] malloc (_Size=0xc) returned 0x2efab30 [0090.491] free (_Block=0x2efab30) [0090.491] malloc (_Size=0xc) returned 0x2efaa10 [0090.491] malloc (_Size=0xc) returned 0x2efa9f8 [0090.492] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.492] SysStringLen (param_1="TABLE") returned 0x5 [0090.492] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.492] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.492] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.492] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.492] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.492] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.492] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.492] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.492] malloc (_Size=0x18) returned 0x2ef2a38 [0090.492] malloc (_Size=0xc) returned 0x2efab30 [0090.492] free (_Block=0x2efab30) [0090.493] malloc (_Size=0xc) returned 0x2efab90 [0090.493] malloc (_Size=0xc) returned 0x2efa9e0 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] SysStringLen (param_1="TABLE") returned 0x5 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0090.493] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.493] SysStringLen (param_1="wmiclimofformat") returned 0xf [0090.493] malloc (_Size=0x18) returned 0x2ef28d8 [0090.494] malloc (_Size=0xc) returned 0x2efaa58 [0090.494] free (_Block=0x2efaa58) [0090.494] malloc (_Size=0xc) returned 0x2efa968 [0090.494] malloc (_Size=0xc) returned 0x2efab30 [0090.494] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.494] SysStringLen (param_1="TABLE") returned 0x5 [0090.494] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.494] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.494] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.494] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.494] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.494] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.494] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.494] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.494] malloc (_Size=0x18) returned 0x2ef2c38 [0090.495] malloc (_Size=0xc) returned 0x2efabd8 [0090.495] free (_Block=0x2efabd8) [0090.495] malloc (_Size=0xc) returned 0x2efa938 [0090.495] malloc (_Size=0xc) returned 0x2efa9b0 [0090.495] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.495] SysStringLen (param_1="TABLE") returned 0x5 [0090.495] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.495] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0090.495] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.495] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0090.495] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.496] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.496] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.496] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0090.496] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0090.496] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0090.496] malloc (_Size=0x18) returned 0x2ef2b38 [0090.496] FreeThreadedDOMDocument:IUnknown:Release (This=0x33a45a8) returned 0x0 [0090.496] free (_Block=0x2ef9550) [0090.496] GetCommandLineW () returned="wmic.exe SHADOWCOPY /nointeractive" [0090.496] malloc (_Size=0x50) returned 0x2efacc8 [0090.497] memcpy_s (in: _Destination=0x2efacc8, _DestinationSize=0x4e, _Source=0x2cb1aa8, _SourceSize=0x44 | out: _Destination=0x2efacc8) returned 0x0 [0090.497] malloc (_Size=0xc) returned 0x2efaba8 [0090.497] malloc (_Size=0xc) returned 0x2efab60 [0090.497] malloc (_Size=0xc) returned 0x2efa9c8 [0090.497] malloc (_Size=0xc) returned 0x2efab78 [0090.497] malloc (_Size=0x80) returned 0x2efad20 [0090.497] GetLocalTime (in: lpSystemTime=0x82f688 | out: lpSystemTime=0x82f688*(wYear=0x7e4, wMonth=0xa, wDayOfWeek=0x0, wDay=0x4, wHour=0x12, wMinute=0x24, wSecond=0x32, wMilliseconds=0x324)) [0090.497] _vsnwprintf (in: _Buffer=0x2efad20, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x82f668 | out: _Buffer="10-04-2020T18:36:50") returned 19 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] malloc (_Size=0x36) returned 0x2efada8 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] malloc (_Size=0x36) returned 0x2efade8 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.497] malloc (_Size=0x16) returned 0x2ef2a58 [0090.497] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.497] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0090.498] malloc (_Size=0x16) returned 0x2ef2ab8 [0090.498] malloc (_Size=0x4) returned 0x2ef0588 [0090.498] free (_Block=0x0) [0090.498] free (_Block=0x2ef2a58) [0090.498] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.498] malloc (_Size=0x4) returned 0x2ef0598 [0090.498] lstrlenW (lpString="/") returned 1 [0090.498] malloc (_Size=0x4) returned 0x2ef2ca8 [0090.498] malloc (_Size=0x8) returned 0x2ef2cb8 [0090.498] memmove_s (in: _Destination=0x2ef2cb8, _DestinationSize=0x4, _Source=0x2ef0588, _SourceSize=0x4 | out: _Destination=0x2ef2cb8) returned 0x0 [0090.498] free (_Block=0x2ef0588) [0090.498] free (_Block=0x0) [0090.498] free (_Block=0x2ef0598) [0090.498] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0090.498] malloc (_Size=0x1c) returned 0x2efae28 [0090.498] lstrlenW (lpString="nointeractive") returned 13 [0090.498] _wcsicmp (_String1="nointeractive", _String2="\"NULL\"") returned 76 [0090.498] malloc (_Size=0x1c) returned 0x2efae50 [0090.498] malloc (_Size=0xc) returned 0x2efa980 [0090.498] memmove_s (in: _Destination=0x2efa980, _DestinationSize=0x8, _Source=0x2ef2cb8, _SourceSize=0x8 | out: _Destination=0x2efa980) returned 0x0 [0090.498] free (_Block=0x2ef2cb8) [0090.498] free (_Block=0x0) [0090.498] free (_Block=0x2efae28) [0090.498] malloc (_Size=0xc) returned 0x2efabd8 [0090.498] lstrlenW (lpString="QUIT") returned 4 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0090.499] lstrlenW (lpString="EXIT") returned 4 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0090.499] free (_Block=0x2efabd8) [0090.499] WbemLocator:IUnknown:AddRef (This=0x2cc4640) returned 0x2 [0090.499] malloc (_Size=0xc) returned 0x2efaaa0 [0090.499] lstrlenW (lpString="/") returned 1 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0090.499] lstrlenW (lpString="-") returned 1 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0090.499] lstrlenW (lpString="CLASS") returned 5 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0090.499] lstrlenW (lpString="PATH") returned 4 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0090.499] lstrlenW (lpString="CONTEXT") returned 7 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.499] malloc (_Size=0x16) returned 0x2ef2ad8 [0090.499] lstrlenW (lpString="SHADOWCOPY") returned 10 [0090.500] GetCurrentThreadId () returned 0x113c [0090.500] ??0CHString@@QAE@XZ () returned 0x82f5e0 [0090.500] malloc (_Size=0xc) returned 0x2efabd8 [0090.500] malloc (_Size=0xc) returned 0x2efaa58 [0090.500] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2cc4640, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988540 | out: ppNamespace=0x988540*=0x2ccac58) returned 0x0 [0092.643] free (_Block=0x2efaa58) [0092.643] free (_Block=0x2efabd8) [0092.643] CoSetProxyBlanket (pProxy=0x2ccac58, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0092.643] ??1CHString@@QAE@XZ () returned 0x740265f8 [0092.643] GetCurrentThreadId () returned 0x113c [0092.643] ??0CHString@@QAE@XZ () returned 0x82f584 [0092.643] malloc (_Size=0xc) returned 0x2efa908 [0092.644] malloc (_Size=0xc) returned 0x2efabd8 [0092.644] malloc (_Size=0xc) returned 0x2efaa58 [0092.644] malloc (_Size=0xc) returned 0x2efac68 [0092.644] SysStringLen (param_1="root\\cli") returned 0x8 [0092.644] SysStringLen (param_1="\\") returned 0x1 [0092.644] malloc (_Size=0xc) returned 0x2efacb0 [0092.644] SysStringLen (param_1="root\\cli\\") returned 0x9 [0092.644] SysStringLen (param_1="ms_409") returned 0x6 [0092.644] free (_Block=0x2efac68) [0092.644] free (_Block=0x2efaa58) [0092.644] free (_Block=0x2efabd8) [0092.644] free (_Block=0x2efa908) [0092.644] malloc (_Size=0xc) returned 0x2efabd8 [0092.644] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2cc4640, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988544 | out: ppNamespace=0x988544*=0x2cf8c20) returned 0x0 [0092.857] free (_Block=0x2efabd8) [0092.857] free (_Block=0x2efacb0) [0092.857] ??1CHString@@QAE@XZ () returned 0x740265f8 [0092.857] GetCurrentThreadId () returned 0x113c [0092.857] ??0CHString@@QAE@XZ () returned 0x82f5e0 [0092.857] malloc (_Size=0xc) returned 0x2efacb0 [0092.857] malloc (_Size=0xc) returned 0x2efabf0 [0092.857] malloc (_Size=0xc) returned 0x2efac80 [0092.857] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0092.857] malloc (_Size=0x3a) returned 0x2efb5e8 [0092.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9414a8, cbMultiByte=-1, lpWideCharStr=0x2efb5e8, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0092.857] free (_Block=0x2efb5e8) [0092.857] malloc (_Size=0xc) returned 0x2efac08 [0092.857] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0092.857] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0092.858] malloc (_Size=0xc) returned 0x2efac38 [0092.858] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0092.858] SysStringLen (param_1="'") returned 0x1 [0092.858] free (_Block=0x2efac08) [0092.858] free (_Block=0x2efac80) [0092.858] free (_Block=0x2efabf0) [0092.858] free (_Block=0x2efacb0) [0092.858] IWbemServices:GetObject (in: This=0x2ccac58, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0x82f5dc*=0x0, ppCallResult=0x0 | out: ppObject=0x82f5dc*=0x2d07a10, ppCallResult=0x0) returned 0x0 [0094.020] malloc (_Size=0xc) returned 0x2efac50 [0094.020] IWbemClassObject:Get (in: This=0x2d07a10, wszName="Target", lFlags=0, pVal=0x82f5b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f5b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.021] free (_Block=0x2efac50) [0094.021] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0094.021] malloc (_Size=0x3e) returned 0x2efb5e8 [0094.021] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0094.021] malloc (_Size=0xc) returned 0x2efac68 [0094.021] IWbemClassObject:Get (in: This=0x2d07a10, wszName="PWhere", lFlags=0, pVal=0x82f5b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f5b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.021] free (_Block=0x2efac68) [0094.021] lstrlenW (lpString=" Where ID = '#'") returned 15 [0094.021] malloc (_Size=0x20) returned 0x2efae28 [0094.021] lstrlenW (lpString=" Where ID = '#'") returned 15 [0094.021] malloc (_Size=0xc) returned 0x2efabf0 [0094.021] IWbemClassObject:Get (in: This=0x2d07a10, wszName="Connection", lFlags=0, pVal=0x82f5b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f5b4*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d07ba8, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.021] free (_Block=0x2efabf0) [0094.022] IUnknown:QueryInterface (in: This=0x2d07ba8, riid=0x946a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x82f5d0 | out: ppvObject=0x82f5d0*=0x2d07ba8) returned 0x0 [0094.022] GetCurrentThreadId () returned 0x113c [0094.022] ??0CHString@@QAE@XZ () returned 0x82f54c [0094.022] malloc (_Size=0xc) returned 0x2efac50 [0094.022] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="Namespace", lFlags=0, pVal=0x82f534*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.022] free (_Block=0x2efac50) [0094.022] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0094.022] malloc (_Size=0x16) returned 0x2ef28f8 [0094.022] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0094.022] malloc (_Size=0xc) returned 0x2efac50 [0094.022] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="Locale", lFlags=0, pVal=0x82f534*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cf061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.022] free (_Block=0x2efac50) [0094.022] lstrlenW (lpString="ms_409") returned 6 [0094.022] malloc (_Size=0xe) returned 0x2efac50 [0094.022] lstrlenW (lpString="ms_409") returned 6 [0094.022] malloc (_Size=0xc) returned 0x2efac68 [0094.022] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="User", lFlags=0, pVal=0x82f534*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cf061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.022] free (_Block=0x2efac68) [0094.022] malloc (_Size=0xc) returned 0x2efac68 [0094.023] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="Password", lFlags=0, pVal=0x82f534*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.023] free (_Block=0x2efac68) [0094.023] malloc (_Size=0xc) returned 0x2efac98 [0094.023] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="Server", lFlags=0, pVal=0x82f534*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.023] free (_Block=0x2efac98) [0094.023] lstrlenW (lpString=".") returned 1 [0094.023] malloc (_Size=0x4) returned 0x2ef2cb8 [0094.023] lstrlenW (lpString=".") returned 1 [0094.023] malloc (_Size=0xc) returned 0x2efac68 [0094.023] IWbemClassObject:Get (in: This=0x2d07ba8, wszName="Authority", lFlags=0, pVal=0x82f534*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cf061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f534*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.023] free (_Block=0x2efac68) [0094.023] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.023] IUnknown:Release (This=0x2d07ba8) returned 0x1 [0094.023] GetCurrentThreadId () returned 0x113c [0094.023] ??0CHString@@QAE@XZ () returned 0x82f540 [0094.023] malloc (_Size=0xc) returned 0x2efac68 [0094.024] IWbemClassObject:Get (in: This=0x2d07a10, wszName="__RELPATH", lFlags=0, pVal=0x82f528*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f528*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.024] free (_Block=0x2efac68) [0094.024] malloc (_Size=0xc) returned 0x2efac80 [0094.024] GetCurrentThreadId () returned 0x113c [0094.024] ??0CHString@@QAE@XZ () returned 0x82f4bc [0094.024] ??0CHString@@QAE@PBG@Z () returned 0x82f4b0 [0094.024] ??0CHString@@QAE@ABV0@@Z () returned 0x82f438 [0094.024] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0094.024] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x2efb630 [0094.024] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0094.024] ?Left@CHString@@QBE?AV1@H@Z () returned 0x82f430 [0094.024] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x82f434 [0094.024] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x82f4b0 [0094.024] ??1CHString@@QAE@XZ () returned 0x1 [0094.024] ??1CHString@@QAE@XZ () returned 0x1 [0094.024] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x82f42c [0094.024] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x82f438 [0094.024] ??1CHString@@QAE@XZ () returned 0x1 [0094.024] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x2efb698 [0094.024] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0094.024] ?Left@CHString@@QBE?AV1@H@Z () returned 0x82f430 [0094.024] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x82f434 [0094.024] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x82f4b0 [0094.024] ??1CHString@@QAE@XZ () returned 0x1 [0094.024] ??1CHString@@QAE@XZ () returned 0x1 [0094.025] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x82f42c [0094.025] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x82f438 [0094.025] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.025] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x740265ec [0094.025] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.025] malloc (_Size=0xc) returned 0x2efac98 [0094.025] malloc (_Size=0xc) returned 0x2efac20 [0094.025] malloc (_Size=0xc) returned 0x2efacb0 [0094.025] malloc (_Size=0xc) returned 0x2efac68 [0094.025] malloc (_Size=0xc) returned 0x2efabf0 [0094.025] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0094.025] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0094.025] malloc (_Size=0xc) returned 0x2efac08 [0094.025] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0094.025] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0094.025] malloc (_Size=0xc) returned 0x2efaa58 [0094.025] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0094.025] SysStringLen (param_1="\"") returned 0x1 [0094.026] free (_Block=0x2efac08) [0094.026] free (_Block=0x2efabf0) [0094.026] free (_Block=0x2efac68) [0094.026] free (_Block=0x2efacb0) [0094.026] free (_Block=0x2efac20) [0094.026] free (_Block=0x2efac98) [0094.026] IWbemServices:GetObject (in: This=0x2cf8c20, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x82f4cc*=0x0, ppCallResult=0x0 | out: ppObject=0x82f4cc*=0x2d08108, ppCallResult=0x0) returned 0x0 [0094.043] malloc (_Size=0xc) returned 0x2efac98 [0094.044] IWbemClassObject:Get (in: This=0x2d08108, wszName="Text", lFlags=0, pVal=0x82f494*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x82f494*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfaf38*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2cea9b0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0094.044] free (_Block=0x2efac98) [0094.044] SafeArrayGetLBound (in: psa=0x2cfaf38, nDim=0x1, plLbound=0x82f4a8 | out: plLbound=0x82f4a8) returned 0x0 [0094.044] SafeArrayGetUBound (in: psa=0x2cfaf38, nDim=0x1, plUbound=0x82f4a4 | out: plUbound=0x82f4a4) returned 0x0 [0094.044] SafeArrayGetElement (in: psa=0x2cfaf38, rgIndices=0x82f4c0, pv=0x82f4b8 | out: pv=0x82f4b8) returned 0x0 [0094.044] malloc (_Size=0xc) returned 0x2efabf0 [0094.044] malloc (_Size=0xc) returned 0x2efacb0 [0094.044] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0094.044] free (_Block=0x2efabf0) [0094.044] IUnknown:Release (This=0x2d08108) returned 0x0 [0094.044] free (_Block=0x2efaa58) [0094.044] ??1CHString@@QAE@XZ () returned 0x1 [0094.044] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.044] free (_Block=0x2efac80) [0094.044] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.044] lstrlenW (lpString="Shadow copy management.") returned 23 [0094.044] malloc (_Size=0x30) returned 0x2efb630 [0094.044] lstrlenW (lpString="Shadow copy management.") returned 23 [0094.045] free (_Block=0x2efacb0) [0094.045] IUnknown:Release (This=0x2d07a10) returned 0x0 [0094.045] free (_Block=0x2efac38) [0094.045] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.045] lstrlenW (lpString="PATH") returned 4 [0094.045] lstrlenW (lpString="/") returned 1 [0094.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="PATH", cchCount2=4) returned 1 [0094.045] lstrlenW (lpString="WHERE") returned 5 [0094.045] lstrlenW (lpString="/") returned 1 [0094.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="WHERE", cchCount2=5) returned 1 [0094.045] lstrlenW (lpString="(") returned 1 [0094.045] lstrlenW (lpString="/") returned 1 [0094.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="(", cchCount2=1) returned 3 [0094.045] lstrlenW (lpString="/") returned 1 [0094.045] lstrlenW (lpString="/") returned 1 [0094.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0094.045] lstrlenW (lpString="?") returned 1 [0094.045] lstrlenW (lpString="nointeractive") returned 13 [0094.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="nointeractive", cchCount1=13, lpString2="?", cchCount2=1) returned 3 [0094.045] free (_Block=0x2efaaa0) [0094.045] GetCurrentThreadId () returned 0x113c [0094.045] ??0CHString@@QAE@PBG@Z () returned 0x82f67c [0094.045] ??YCHString@@QAEABV0@PBG@Z () returned 0x82f67c [0094.047] malloc (_Size=0x800) returned 0x2efb6f0 [0094.047] LoadStringW (in: hInstance=0x0, uID=0xac5c, lpBuffer=0x2efb6f0, cchBufferMax=1024 | out: lpBuffer="Unexpected switch at this level.\r\n") returned 0x22 [0094.047] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0094.047] malloc (_Size=0x23) returned 0x2efbef8 [0094.048] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x2efbef8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Unexpected switch at this level.\r\n", lpUsedDefaultChar=0x0) returned 35 [0094.048] __iob_func () returned 0x776f2608 [0094.048] fprintf (in: _File=0x776f2648, _Format="%s" | out: _File=0x776f2648) returned 34 [0094.053] __iob_func () returned 0x776f2608 [0094.053] fflush (in: _File=0x776f2648 | out: _File=0x776f2648) returned 0 [0094.053] free (_Block=0x2efbef8) [0094.053] free (_Block=0x2efb6f0) [0094.053] ??1CHString@@QAE@XZ () returned 0x1 [0094.053] ??0CHString@@QAE@PBG@Z () returned 0x82f684 [0094.053] ??YCHString@@QAEABV0@PBG@Z () returned 0x82f684 [0094.053] GetCurrentThreadId () returned 0x113c [0094.053] GetLastError () returned 0x0 [0094.053] ??1CHString@@QAE@XZ () returned 0x1 [0094.053] free (_Block=0x2efab78) [0094.053] free (_Block=0x2efa9c8) [0094.053] free (_Block=0x2efab60) [0094.053] free (_Block=0x2efaba8) [0094.053] free (_Block=0x2efada8) [0094.054] free (_Block=0x2ef2ad8) [0094.054] free (_Block=0x2efb630) [0094.054] free (_Block=0x2efb5e8) [0094.054] free (_Block=0x2efac50) [0094.054] free (_Block=0x2ef28f8) [0094.054] free (_Block=0x2ef2cb8) [0094.054] free (_Block=0x2ef04f0) [0094.054] free (_Block=0x2efae28) [0094.054] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0094.054] free (_Block=0x2efade8) [0094.054] free (_Block=0x2ef2ab8) [0094.054] free (_Block=0x2ef2ca8) [0094.054] free (_Block=0x2efae50) [0094.054] free (_Block=0x2ef2598) [0094.054] free (_Block=0x2ef25e0) [0094.054] free (_Block=0x2ef2628) [0094.054] free (_Block=0x2ef11a8) [0094.054] free (_Block=0x2ef26c0) [0094.054] free (_Block=0x2ef2c90) [0094.054] free (_Block=0x2ef2b98) [0094.054] free (_Block=0x2ef2c78) [0094.054] free (_Block=0x2ef2b78) [0094.054] free (_Block=0x2ef04d8) [0094.054] free (_Block=0x2ef2bd8) [0094.054] free (_Block=0x2ef2800) [0094.054] free (_Block=0x2ef2818) [0094.054] free (_Block=0x2ef27c8) [0094.054] free (_Block=0x2ef27e0) [0094.055] free (_Block=0x2ef2838) [0094.055] free (_Block=0x2ef2850) [0094.055] free (_Block=0x2ef04a0) [0094.055] free (_Block=0x2ef04b8) [0094.055] free (_Block=0x2ef2758) [0094.055] free (_Block=0x2ef2770) [0094.055] free (_Block=0x2ef2720) [0094.055] free (_Block=0x2ef2738) [0094.055] free (_Block=0x2ef2790) [0094.055] free (_Block=0x2ef27a8) [0094.055] free (_Block=0x2ef26e8) [0094.055] free (_Block=0x2ef2700) [0094.055] free (_Block=0x2ef2698) [0094.055] free (_Block=0x2ef2670) [0094.055] free (_Block=0x2efad20) [0094.055] WbemLocator:IUnknown:Release (This=0x2cf8c20) returned 0x0 [0094.056] WbemLocator:IUnknown:Release (This=0x2ccac58) returned 0x0 [0094.056] WbemLocator:IUnknown:Release (This=0x2cc4640) returned 0x1 [0094.056] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0094.056] WbemLocator:IUnknown:Release (This=0x2cc4640) returned 0x0 [0094.056] free (_Block=0x2efa968) [0094.056] free (_Block=0x2efab30) [0094.056] free (_Block=0x2ef2c38) [0094.056] free (_Block=0x2efa938) [0094.056] free (_Block=0x2efa9b0) [0094.056] free (_Block=0x2ef2b38) [0094.056] free (_Block=0x2efabc0) [0094.056] free (_Block=0x2efaa28) [0094.057] free (_Block=0x2ef28b8) [0094.057] free (_Block=0x2efaa40) [0094.057] free (_Block=0x2efab00) [0094.057] free (_Block=0x2ef2a18) [0094.057] free (_Block=0x2efaad0) [0094.057] free (_Block=0x2efaae8) [0094.057] free (_Block=0x2ef2c18) [0094.057] free (_Block=0x2efa8f0) [0094.057] free (_Block=0x2efab48) [0094.057] free (_Block=0x2ef2998) [0094.057] free (_Block=0x2efaa10) [0094.057] free (_Block=0x2efa9f8) [0094.057] free (_Block=0x2ef2a38) [0094.057] free (_Block=0x2efab90) [0094.057] free (_Block=0x2efa9e0) [0094.057] free (_Block=0x2ef28d8) [0094.057] free (_Block=0x2ef9538) [0094.057] free (_Block=0x2efa920) [0094.057] free (_Block=0x2ef2bf8) [0094.057] free (_Block=0x2efa950) [0094.057] free (_Block=0x2efaa70) [0094.057] free (_Block=0x2ef2938) [0094.057] free (_Block=0x2efa998) [0094.057] free (_Block=0x2efaa88) [0094.057] free (_Block=0x2ef2b18) [0094.058] free (_Block=0x2efaab8) [0094.058] free (_Block=0x2efab18) [0094.058] free (_Block=0x2ef2958) [0094.058] free (_Block=0x2ef95c8) [0094.058] free (_Block=0x2ef95e0) [0094.058] free (_Block=0x2ef2898) [0094.058] free (_Block=0x2ef9580) [0094.058] free (_Block=0x2ef9520) [0094.058] free (_Block=0x2ef2a98) [0094.058] free (_Block=0x2ef9508) [0094.058] free (_Block=0x2ef9598) [0094.058] free (_Block=0x2ef2bb8) [0094.058] free (_Block=0x2ef9610) [0094.058] free (_Block=0x2ef9688) [0094.058] free (_Block=0x2ef2b58) [0094.058] free (_Block=0x2ef96b8) [0094.058] free (_Block=0x2ef9670) [0094.058] free (_Block=0x2ef29f8) [0094.058] free (_Block=0x2ef9640) [0094.058] free (_Block=0x2ef95f8) [0094.058] free (_Block=0x2ef2c58) [0094.058] free (_Block=0x2ef9628) [0094.058] free (_Block=0x2ef9568) [0094.058] free (_Block=0x2ef2a78) [0094.058] free (_Block=0x2ef9658) [0094.058] free (_Block=0x2ef96a0) [0094.059] free (_Block=0x2ef29d8) [0094.059] free (_Block=0x2ef95b0) [0094.059] free (_Block=0x2ef94f0) [0094.059] free (_Block=0x2ef29b8) [0094.059] CoUninitialize () [0094.426] exit (_Code=44124) [0094.426] free (_Block=0x2efacc8) [0094.426] free (_Block=0x2ef0ff8) [0094.426] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.426] free (_Block=0x2ef0538) [0094.426] free (_Block=0x2ef26d8) [0094.426] free (_Block=0x2ef0fd8) [0094.426] free (_Block=0x2ef0fb8) [0094.427] free (_Block=0x2ef0f88) [0094.427] free (_Block=0x2ef0f68) [0094.427] free (_Block=0x2ef0f38) [0094.427] free (_Block=0x2ef0ef8) [0094.427] free (_Block=0x2ef0ed8) [0094.427] ??1CHString@@QAE@XZ () returned 0x740265f8 [0094.427] free (_Block=0x2efa980) Thread: id = 115 os_tid = 0x300 Thread: id = 132 os_tid = 0xf0c Thread: id = 133 os_tid = 0x1240 Thread: id = 134 os_tid = 0xa08 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x11e6f000" os_pid = "0x1154" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x10cc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0x1160 Thread: id = 112 os_tid = 0xe90 Thread: id = 113 os_tid = 0xd28 Process: id = "7" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x6f23000" os_pid = "0x1164" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "taskhostw.exe Logon" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 117 os_tid = 0x1284 Thread: id = 118 os_tid = 0x1220 Thread: id = 119 os_tid = 0x11d4 Thread: id = 120 os_tid = 0x11d0 Thread: id = 121 os_tid = 0x11cc Thread: id = 122 os_tid = 0x11c8 Thread: id = 123 os_tid = 0x11c4 Thread: id = 124 os_tid = 0x11c0 Thread: id = 125 os_tid = 0x11b0 Thread: id = 126 os_tid = 0x119c Thread: id = 127 os_tid = 0x1168 Thread: id = 128 os_tid = 0x1210 Process: id = "8" image_name = "trustedinstaller.exe" filename = "c:\\windows\\servicing\\trustedinstaller.exe" page_root = "0x18775000" os_pid = "0x1244" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007b29b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 136 os_tid = 0x900 Thread: id = 137 os_tid = 0xa50 Thread: id = 138 os_tid = 0xcd4 Thread: id = 139 os_tid = 0x36c Thread: id = 140 os_tid = 0x510 Thread: id = 141 os_tid = 0x760 Thread: id = 142 os_tid = 0x6d0 Thread: id = 143 os_tid = 0xe6c Thread: id = 144 os_tid = 0x1228 Process: id = "9" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x4b23d000" os_pid = "0xe50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 145 os_tid = 0x11f0 Thread: id = 149 os_tid = 0x11bc Thread: id = 150 os_tid = 0xf4c Thread: id = 153 os_tid = 0x384 Thread: id = 154 os_tid = 0xd14 Thread: id = 155 os_tid = 0xd1c Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x11d8d000" os_pid = "0xf20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe50" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 146 os_tid = 0xe14 Thread: id = 147 os_tid = 0xd7c Thread: id = 148 os_tid = 0x60 Process: id = "11" image_name = "tiworker.exe" filename = "c:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.410_none_9e914f9d2d85dacb\\tiworker.exe" page_root = "0x1529b000" os_pid = "0xd2c" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.410_none_9e914f9d2d85dacb\\TiWorker.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007b29b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 156 os_tid = 0xb70 Thread: id = 157 os_tid = 0x58 Thread: id = 158 os_tid = 0xd90 Thread: id = 159 os_tid = 0x25c Thread: id = 160 os_tid = 0x994 Thread: id = 161 os_tid = 0xdf8 Thread: id = 162 os_tid = 0x1ec Process: id = "12" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x1c5d1000" os_pid = "0xe54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "wmic.exe SHADOWCOPY /nointeractive" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 163 os_tid = 0x440 [0115.876] GetModuleHandleA (lpModuleName=0x0) returned 0x940000 [0115.876] __set_app_type (_Type=0x1) [0115.876] __p__fmode () returned 0x776f3c14 [0115.876] __p__commode () returned 0x776f49ec [0115.876] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x979af0) returned 0x0 [0115.876] __wgetmainargs (in: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0, _DoWildCard=0, _StartInfo=0x9881bc | out: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0) returned 0 [0115.877] ??0CHString@@QAE@XZ () returned 0x9885ec [0115.877] malloc (_Size=0x18) returned 0x3110ed8 [0115.877] malloc (_Size=0x38) returned 0x3110ef8 [0115.877] malloc (_Size=0x28) returned 0x3110f38 [0115.877] malloc (_Size=0x18) returned 0x3110f68 [0115.877] malloc (_Size=0x24) returned 0x3110f88 [0115.877] malloc (_Size=0x18) returned 0x3110fb8 [0115.877] malloc (_Size=0x18) returned 0x3110fd8 [0115.877] ??0CHString@@QAE@XZ () returned 0x9888fc [0115.877] malloc (_Size=0x18) returned 0x3110ff8 [0115.877] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0115.877] SetConsoleCtrlHandler (HandlerRoutine=0x973cc0, Add=1) returned 1 [0115.878] _onexit (_Func=0x97f370) returned 0x97f370 [0115.878] _onexit (_Func=0x97f380) returned 0x97f380 [0115.878] _onexit (_Func=0x97f390) returned 0x97f390 [0115.878] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0115.878] ResolveDelayLoadedAPI () returned 0x74a22590 [0115.878] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.883] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0119.861] CoCreateInstance (in: rclsid=0x946a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x988510 | out: ppv=0x988510*=0x2ce4640) returned 0x0 [0120.166] GetCurrentProcess () returned 0xffffffff [0120.166] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2c7f7dc | out: TokenHandle=0x2c7f7dc*=0x1a0) returned 1 [0120.167] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2c7f7d8 | out: TokenInformation=0x0, ReturnLength=0x2c7f7d8) returned 0 [0120.167] malloc (_Size=0x118) returned 0x3112598 [0120.167] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x3112598, TokenInformationLength=0x118, ReturnLength=0x2c7f7d8 | out: TokenInformation=0x3112598, ReturnLength=0x2c7f7d8) returned 1 [0120.167] AdjustTokenPrivileges (in: TokenHandle=0x1a0, DisableAllPrivileges=0, NewState=0x3112598*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0120.167] free (_Block=0x3112598) [0120.167] CloseHandle (hObject=0x1a0) returned 1 [0120.167] malloc (_Size=0x40) returned 0x3112598 [0120.167] malloc (_Size=0x40) returned 0x31125e0 [0120.167] malloc (_Size=0x40) returned 0x3112628 [0120.167] SetThreadUILanguage (LangId=0x0) returned 0x2b80409 [0120.280] _vsnwprintf (in: _Buffer=0x3112628, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x2c7f764 | out: _Buffer="ms_409") returned 6 [0120.280] malloc (_Size=0x20) returned 0x3112670 [0120.280] GetComputerNameW (in: lpBuffer=0x3112670, nSize=0x2c7f7c8 | out: lpBuffer="NQDPDE", nSize=0x2c7f7c8) returned 1 [0120.280] lstrlenW (lpString="NQDPDE") returned 6 [0120.280] malloc (_Size=0xe) returned 0x31111a8 [0120.280] lstrlenW (lpString="NQDPDE") returned 6 [0120.280] ResolveDelayLoadedAPI () returned 0x7444db00 [0120.280] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x2c7f7dc | out: lpNameBuffer=0x0, nSize=0x2c7f7dc) returned 0x2b8e000 [0120.282] GetLastError () returned 0xea [0120.282] malloc (_Size=0x1e) returned 0x3112698 [0120.282] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3112698, nSize=0x2c7f7dc | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x2c7f7dc) returned 0x1 [0120.282] lstrlenW (lpString="") returned 0 [0120.282] lstrlenW (lpString="NQDPDE") returned 6 [0120.282] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0120.284] lstrlenW (lpString=".") returned 1 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0120.284] lstrlenW (lpString="LOCALHOST") returned 9 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0120.284] free (_Block=0x31111a8) [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] malloc (_Size=0xe) returned 0x31111a8 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] malloc (_Size=0xe) returned 0x31126c0 [0120.284] lstrlenW (lpString="NQDPDE") returned 6 [0120.284] malloc (_Size=0x4) returned 0x31126d8 [0120.284] malloc (_Size=0xc) returned 0x31126e8 [0120.284] ResolveDelayLoadedAPI () returned 0x7745b870 [0120.350] malloc (_Size=0x18) returned 0x3112700 [0120.350] malloc (_Size=0xc) returned 0x3112720 [0120.350] SysStringLen (param_1="IDENTIFY") returned 0x8 [0120.350] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0120.350] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0120.350] SysStringLen (param_1="IDENTIFY") returned 0x8 [0120.350] malloc (_Size=0x18) returned 0x3112738 [0120.350] malloc (_Size=0xc) returned 0x3112758 [0120.350] SysStringLen (param_1="IMPERSONATE") returned 0xb [0120.350] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0120.350] SysStringLen (param_1="IMPERSONATE") returned 0xb [0120.350] SysStringLen (param_1="IDENTIFY") returned 0x8 [0120.350] SysStringLen (param_1="IDENTIFY") returned 0x8 [0120.350] SysStringLen (param_1="IMPERSONATE") returned 0xb [0120.350] malloc (_Size=0x18) returned 0x3112770 [0120.350] malloc (_Size=0xc) returned 0x3112790 [0120.350] SysStringLen (param_1="DELEGATE") returned 0x8 [0120.350] SysStringLen (param_1="IDENTIFY") returned 0x8 [0120.350] SysStringLen (param_1="DELEGATE") returned 0x8 [0120.350] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0120.350] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0120.350] SysStringLen (param_1="DELEGATE") returned 0x8 [0120.351] malloc (_Size=0x18) returned 0x31127a8 [0120.351] malloc (_Size=0xc) returned 0x31127c8 [0120.351] malloc (_Size=0x18) returned 0x31127e0 [0120.351] malloc (_Size=0xc) returned 0x3112800 [0120.351] SysStringLen (param_1="NONE") returned 0x4 [0120.351] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.351] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.351] SysStringLen (param_1="NONE") returned 0x4 [0120.351] malloc (_Size=0x18) returned 0x3112818 [0120.351] malloc (_Size=0xc) returned 0x3112838 [0120.351] SysStringLen (param_1="CONNECT") returned 0x7 [0120.351] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.351] malloc (_Size=0x18) returned 0x3112850 [0120.351] malloc (_Size=0xc) returned 0x31104a0 [0120.351] SysStringLen (param_1="CALL") returned 0x4 [0120.351] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.352] SysStringLen (param_1="CALL") returned 0x4 [0120.352] SysStringLen (param_1="CONNECT") returned 0x7 [0120.352] malloc (_Size=0x18) returned 0x31104b8 [0120.352] malloc (_Size=0xc) returned 0x31104d8 [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] SysStringLen (param_1="NONE") returned 0x4 [0120.352] SysStringLen (param_1="NONE") returned 0x4 [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] malloc (_Size=0x18) returned 0x3112898 [0120.352] malloc (_Size=0xc) returned 0x3112c78 [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] SysStringLen (param_1="NONE") returned 0x4 [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] malloc (_Size=0x18) returned 0x3112bf8 [0120.352] malloc (_Size=0xc) returned 0x3112c90 [0120.352] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0120.352] SysStringLen (param_1="DEFAULT") returned 0x7 [0120.352] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0120.352] SysStringLen (param_1="PKT") returned 0x3 [0120.352] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0120.352] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0120.352] malloc (_Size=0x18) returned 0x3112c58 [0120.352] malloc (_Size=0x40) returned 0x31104f0 [0120.353] malloc (_Size=0x20a) returned 0x31194c8 [0120.353] GetSystemDirectoryW (in: lpBuffer=0x31194c8, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0120.353] free (_Block=0x31194c8) [0120.353] malloc (_Size=0xc) returned 0x3112ca8 [0120.353] malloc (_Size=0xc) returned 0x3110538 [0120.353] malloc (_Size=0xc) returned 0x3110550 [0120.353] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0120.353] SysStringLen (param_1="\\wbem\\") returned 0x6 [0120.353] free (_Block=0x3112ca8) [0120.353] free (_Block=0x3110538) [0120.353] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0120.353] free (_Block=0x3110550) [0120.353] malloc (_Size=0xc) returned 0x31196b8 [0120.353] malloc (_Size=0xc) returned 0x3119628 [0120.353] malloc (_Size=0xc) returned 0x31195b0 [0120.353] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0120.353] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0120.353] free (_Block=0x31196b8) [0120.353] free (_Block=0x3119628) [0120.353] GetCurrentThreadId () returned 0x440 [0120.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x2c7f2ec | out: phkResult=0x2c7f2ec*=0x1ac) returned 0x0 [0120.354] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x2c7f2f8, lpcbData=0x2c7f2f4*=0x400 | out: lpType=0x0, lpData=0x2c7f2f8*=0x30, lpcbData=0x2c7f2f4*=0x4) returned 0x0 [0120.354] _wcsicmp (_String1="0", _String2="1") returned -1 [0120.354] _wcsicmp (_String1="0", _String2="2") returned -2 [0120.354] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2c7f2f4*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x2c7f2f4*=0x42) returned 0x0 [0120.354] malloc (_Size=0x86) returned 0x31196d0 [0120.354] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x31196d0, lpcbData=0x2c7f2f4*=0x42 | out: lpType=0x0, lpData=0x31196d0*=0x25, lpcbData=0x2c7f2f4*=0x42) returned 0x0 [0120.354] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0120.354] malloc (_Size=0x42) returned 0x3110538 [0120.354] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0120.354] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x2c7f2f8, lpcbData=0x2c7f2f4*=0x400 | out: lpType=0x0, lpData=0x2c7f2f8*=0x36, lpcbData=0x2c7f2f4*=0xc) returned 0x0 [0120.354] _wtol (_String="65536") returned 65536 [0120.354] free (_Block=0x31196d0) [0120.354] RegCloseKey (hKey=0x0) returned 0x6 [0120.354] CoCreateInstance (in: rclsid=0x946ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x2c7f788 | out: ppv=0x2c7f788*=0x2f745a8) returned 0x0 [0120.371] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x2f745a8, xmlSource=0x2c7f70c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x2c7f774 | out: isSuccessful=0x2c7f774*=0xffff) returned 0x0 [0120.561] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x2f745a8, DOMElement=0x2c7f784 | out: DOMElement=0x2c7f784) returned 0x0 [0120.561] malloc (_Size=0xc) returned 0x3119550 [0120.563] free (_Block=0x3119550) [0120.563] malloc (_Size=0xc) returned 0x3119670 [0120.564] free (_Block=0x3119670) [0120.564] malloc (_Size=0xc) returned 0x3119610 [0120.564] malloc (_Size=0xc) returned 0x31195c8 [0120.564] malloc (_Size=0x18) returned 0x3112b18 [0120.564] malloc (_Size=0xc) returned 0x31195e0 [0120.564] free (_Block=0x31195e0) [0120.565] malloc (_Size=0xc) returned 0x3119628 [0120.565] malloc (_Size=0xc) returned 0x3119550 [0120.565] SysStringLen (param_1="VALUE") returned 0x5 [0120.565] SysStringLen (param_1="TABLE") returned 0x5 [0120.565] SysStringLen (param_1="TABLE") returned 0x5 [0120.565] SysStringLen (param_1="VALUE") returned 0x5 [0120.565] malloc (_Size=0x18) returned 0x3112c18 [0120.565] malloc (_Size=0xc) returned 0x3119580 [0120.565] free (_Block=0x3119580) [0120.565] malloc (_Size=0xc) returned 0x31195e0 [0120.566] malloc (_Size=0xc) returned 0x3119640 [0120.566] SysStringLen (param_1="LIST") returned 0x4 [0120.566] SysStringLen (param_1="TABLE") returned 0x5 [0120.566] malloc (_Size=0x18) returned 0x31129d8 [0120.566] malloc (_Size=0xc) returned 0x31195f8 [0120.566] free (_Block=0x31195f8) [0120.566] malloc (_Size=0xc) returned 0x3119688 [0120.566] malloc (_Size=0xc) returned 0x31195f8 [0120.566] SysStringLen (param_1="RAWXML") returned 0x6 [0120.566] SysStringLen (param_1="TABLE") returned 0x5 [0120.566] SysStringLen (param_1="RAWXML") returned 0x6 [0120.567] SysStringLen (param_1="LIST") returned 0x4 [0120.567] SysStringLen (param_1="LIST") returned 0x4 [0120.567] SysStringLen (param_1="RAWXML") returned 0x6 [0120.567] malloc (_Size=0x18) returned 0x3112a78 [0120.567] malloc (_Size=0xc) returned 0x3119658 [0120.567] free (_Block=0x3119658) [0120.567] malloc (_Size=0xc) returned 0x3119670 [0120.567] malloc (_Size=0xc) returned 0x3119658 [0120.567] SysStringLen (param_1="HTABLE") returned 0x6 [0120.567] SysStringLen (param_1="TABLE") returned 0x5 [0120.567] SysStringLen (param_1="HTABLE") returned 0x6 [0120.567] SysStringLen (param_1="LIST") returned 0x4 [0120.568] malloc (_Size=0x18) returned 0x31128b8 [0120.568] malloc (_Size=0xc) returned 0x31196a0 [0120.568] free (_Block=0x31196a0) [0120.568] malloc (_Size=0xc) returned 0x31196a0 [0120.568] malloc (_Size=0xc) returned 0x3119568 [0120.568] SysStringLen (param_1="HFORM") returned 0x5 [0120.568] SysStringLen (param_1="TABLE") returned 0x5 [0120.568] SysStringLen (param_1="HFORM") returned 0x5 [0120.568] SysStringLen (param_1="LIST") returned 0x4 [0120.568] SysStringLen (param_1="HFORM") returned 0x5 [0120.568] SysStringLen (param_1="HTABLE") returned 0x6 [0120.568] malloc (_Size=0x18) returned 0x31128d8 [0120.569] malloc (_Size=0xc) returned 0x3119508 [0120.569] free (_Block=0x3119508) [0120.569] malloc (_Size=0xc) returned 0x31196b8 [0120.569] malloc (_Size=0xc) returned 0x3119580 [0120.569] SysStringLen (param_1="XML") returned 0x3 [0120.569] SysStringLen (param_1="TABLE") returned 0x5 [0120.569] SysStringLen (param_1="XML") returned 0x3 [0120.569] SysStringLen (param_1="VALUE") returned 0x5 [0120.569] SysStringLen (param_1="VALUE") returned 0x5 [0120.569] SysStringLen (param_1="XML") returned 0x3 [0120.569] malloc (_Size=0x18) returned 0x3112c38 [0120.570] malloc (_Size=0xc) returned 0x31194f0 [0120.570] free (_Block=0x31194f0) [0120.570] malloc (_Size=0xc) returned 0x31194f0 [0120.570] malloc (_Size=0xc) returned 0x3119598 [0120.570] SysStringLen (param_1="MOF") returned 0x3 [0120.570] SysStringLen (param_1="TABLE") returned 0x5 [0120.570] SysStringLen (param_1="MOF") returned 0x3 [0120.570] SysStringLen (param_1="LIST") returned 0x4 [0120.570] SysStringLen (param_1="MOF") returned 0x3 [0120.570] SysStringLen (param_1="RAWXML") returned 0x6 [0120.570] SysStringLen (param_1="LIST") returned 0x4 [0120.570] SysStringLen (param_1="MOF") returned 0x3 [0120.570] malloc (_Size=0x18) returned 0x3112938 [0120.571] malloc (_Size=0xc) returned 0x3119508 [0120.571] free (_Block=0x3119508) [0120.571] malloc (_Size=0xc) returned 0x3119508 [0120.571] malloc (_Size=0xc) returned 0x3119520 [0120.571] SysStringLen (param_1="CSV") returned 0x3 [0120.571] SysStringLen (param_1="TABLE") returned 0x5 [0120.571] SysStringLen (param_1="CSV") returned 0x3 [0120.571] SysStringLen (param_1="LIST") returned 0x4 [0120.571] SysStringLen (param_1="CSV") returned 0x3 [0120.571] SysStringLen (param_1="HTABLE") returned 0x6 [0120.571] SysStringLen (param_1="CSV") returned 0x3 [0120.571] SysStringLen (param_1="HFORM") returned 0x5 [0120.571] malloc (_Size=0x18) returned 0x31129f8 [0120.572] malloc (_Size=0xc) returned 0x3119538 [0120.572] free (_Block=0x3119538) [0120.572] malloc (_Size=0xc) returned 0x3119538 [0120.572] malloc (_Size=0xc) returned 0x311a9e0 [0120.572] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.572] SysStringLen (param_1="TABLE") returned 0x5 [0120.572] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.572] SysStringLen (param_1="VALUE") returned 0x5 [0120.572] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.572] SysStringLen (param_1="XML") returned 0x3 [0120.572] SysStringLen (param_1="XML") returned 0x3 [0120.573] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.573] malloc (_Size=0x18) returned 0x31128f8 [0120.573] malloc (_Size=0xc) returned 0x311ab60 [0120.573] free (_Block=0x311ab60) [0120.573] malloc (_Size=0xc) returned 0x311a9f8 [0120.573] malloc (_Size=0xc) returned 0x311aa88 [0120.573] SysStringLen (param_1="texttablewsys") returned 0xd [0120.573] SysStringLen (param_1="TABLE") returned 0x5 [0120.573] SysStringLen (param_1="texttablewsys") returned 0xd [0120.573] SysStringLen (param_1="XML") returned 0x3 [0120.573] SysStringLen (param_1="texttablewsys") returned 0xd [0120.573] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.574] SysStringLen (param_1="XML") returned 0x3 [0120.574] SysStringLen (param_1="texttablewsys") returned 0xd [0120.574] malloc (_Size=0x18) returned 0x3112a18 [0120.574] malloc (_Size=0xc) returned 0x311a9b0 [0120.574] free (_Block=0x311a9b0) [0120.574] malloc (_Size=0xc) returned 0x311a950 [0120.574] malloc (_Size=0xc) returned 0x311aae8 [0120.574] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.574] SysStringLen (param_1="TABLE") returned 0x5 [0120.574] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.574] SysStringLen (param_1="XML") returned 0x3 [0120.574] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.575] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.575] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.575] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.575] malloc (_Size=0x18) returned 0x3112b98 [0120.575] malloc (_Size=0xc) returned 0x311aa28 [0120.575] free (_Block=0x311aa28) [0120.575] malloc (_Size=0xc) returned 0x311a980 [0120.575] malloc (_Size=0xc) returned 0x311a908 [0120.575] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.575] SysStringLen (param_1="TABLE") returned 0x5 [0120.575] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.580] SysStringLen (param_1="XML") returned 0x3 [0120.580] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.580] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.580] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.580] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.580] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.580] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.580] malloc (_Size=0x18) returned 0x3112a38 [0120.580] malloc (_Size=0xc) returned 0x311ab00 [0120.580] free (_Block=0x311ab00) [0120.580] malloc (_Size=0xc) returned 0x311ab48 [0120.581] malloc (_Size=0xc) returned 0x311aa10 [0120.581] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.581] SysStringLen (param_1="TABLE") returned 0x5 [0120.581] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.581] SysStringLen (param_1="XML") returned 0x3 [0120.581] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.581] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.581] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.581] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.581] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.581] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.581] malloc (_Size=0x18) returned 0x3112978 [0120.581] malloc (_Size=0xc) returned 0x311aaa0 [0120.582] free (_Block=0x311aaa0) [0120.582] malloc (_Size=0xc) returned 0x311aa28 [0120.582] malloc (_Size=0xc) returned 0x311ab60 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] SysStringLen (param_1="TABLE") returned 0x5 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] SysStringLen (param_1="XML") returned 0x3 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.582] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0120.582] malloc (_Size=0x18) returned 0x3112b38 [0120.583] malloc (_Size=0xc) returned 0x311ab90 [0120.583] free (_Block=0x311ab90) [0120.583] malloc (_Size=0xc) returned 0x311a9b0 [0120.583] malloc (_Size=0xc) returned 0x311abd8 [0120.583] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.583] SysStringLen (param_1="TABLE") returned 0x5 [0120.583] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.583] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.583] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.583] SysStringLen (param_1="XML") returned 0x3 [0120.583] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.583] SysStringLen (param_1="texttablewsys") returned 0xd [0120.583] SysStringLen (param_1="XML") returned 0x3 [0120.583] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.583] malloc (_Size=0x18) returned 0x3112a58 [0120.584] malloc (_Size=0xc) returned 0x311aa40 [0120.584] free (_Block=0x311aa40) [0120.584] malloc (_Size=0xc) returned 0x311a920 [0120.584] malloc (_Size=0xc) returned 0x311ab90 [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.584] SysStringLen (param_1="TABLE") returned 0x5 [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.584] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.584] SysStringLen (param_1="XML") returned 0x3 [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.584] SysStringLen (param_1="texttablewsys") returned 0xd [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.584] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0120.584] SysStringLen (param_1="XML") returned 0x3 [0120.584] SysStringLen (param_1="htable-sortby") returned 0xd [0120.585] malloc (_Size=0x18) returned 0x3112998 [0120.585] malloc (_Size=0xc) returned 0x311aab8 [0120.585] free (_Block=0x311aab8) [0120.585] malloc (_Size=0xc) returned 0x311ab78 [0120.585] malloc (_Size=0xc) returned 0x311aba8 [0120.585] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.585] SysStringLen (param_1="TABLE") returned 0x5 [0120.585] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.585] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.585] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.586] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.586] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.586] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.586] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.586] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.586] malloc (_Size=0x18) returned 0x3112a98 [0120.586] malloc (_Size=0xc) returned 0x311aa40 [0120.586] free (_Block=0x311aa40) [0120.586] malloc (_Size=0xc) returned 0x311aa40 [0120.586] malloc (_Size=0xc) returned 0x311aa58 [0120.586] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] SysStringLen (param_1="TABLE") returned 0x5 [0120.587] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.587] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.587] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0120.587] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0120.587] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.587] SysStringLen (param_1="wmiclimofformat") returned 0xf [0120.587] malloc (_Size=0x18) returned 0x3112958 [0120.587] malloc (_Size=0xc) returned 0x311aaa0 [0120.587] free (_Block=0x311aaa0) [0120.588] malloc (_Size=0xc) returned 0x311abc0 [0120.588] malloc (_Size=0xc) returned 0x311aaa0 [0120.588] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.588] SysStringLen (param_1="TABLE") returned 0x5 [0120.588] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.588] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.588] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.588] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.588] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.588] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.588] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.588] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.588] malloc (_Size=0x18) returned 0x3112bb8 [0120.588] malloc (_Size=0xc) returned 0x311a9c8 [0120.589] free (_Block=0x311a9c8) [0120.589] malloc (_Size=0xc) returned 0x311aa70 [0120.589] malloc (_Size=0xc) returned 0x311a968 [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] SysStringLen (param_1="TABLE") returned 0x5 [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0120.589] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0120.589] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0120.589] malloc (_Size=0x18) returned 0x3112918 [0120.590] FreeThreadedDOMDocument:IUnknown:Release (This=0x2f745a8) returned 0x0 [0120.590] free (_Block=0x31195b0) [0120.590] GetCommandLineW () returned="wmic.exe SHADOWCOPY /nointeractive" [0120.590] malloc (_Size=0x50) returned 0x311acc8 [0120.590] memcpy_s (in: _Destination=0x311acc8, _DestinationSize=0x4e, _Source=0x2cd1aa8, _SourceSize=0x44 | out: _Destination=0x311acc8) returned 0x0 [0120.590] malloc (_Size=0xc) returned 0x311a998 [0120.590] malloc (_Size=0xc) returned 0x311a8f0 [0120.590] malloc (_Size=0xc) returned 0x311a9c8 [0120.590] malloc (_Size=0xc) returned 0x311aab8 [0120.590] malloc (_Size=0x80) returned 0x311ad20 [0120.590] GetLocalTime (in: lpSystemTime=0x2c7f738 | out: lpSystemTime=0x2c7f738*(wYear=0x7e4, wMonth=0xa, wDayOfWeek=0x0, wDay=0x4, wHour=0x12, wMinute=0x25, wSecond=0x14, wMilliseconds=0x375)) [0120.591] _vsnwprintf (in: _Buffer=0x311ad20, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x2c7f718 | out: _Buffer="10-04-2020T18:37:20") returned 19 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] malloc (_Size=0x36) returned 0x311ada8 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] malloc (_Size=0x36) returned 0x311ade8 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] malloc (_Size=0x16) returned 0x3112bd8 [0120.591] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.591] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0120.591] malloc (_Size=0x16) returned 0x31129b8 [0120.591] malloc (_Size=0x4) returned 0x3110588 [0120.591] free (_Block=0x0) [0120.591] free (_Block=0x3112bd8) [0120.591] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.591] malloc (_Size=0x4) returned 0x3110598 [0120.591] lstrlenW (lpString="/") returned 1 [0120.591] malloc (_Size=0x4) returned 0x3112ca8 [0120.591] malloc (_Size=0x8) returned 0x3112cb8 [0120.591] memmove_s (in: _Destination=0x3112cb8, _DestinationSize=0x4, _Source=0x3110588, _SourceSize=0x4 | out: _Destination=0x3112cb8) returned 0x0 [0120.592] free (_Block=0x3110588) [0120.592] free (_Block=0x0) [0120.592] free (_Block=0x3110598) [0120.592] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0120.592] malloc (_Size=0x1c) returned 0x311ae28 [0120.592] lstrlenW (lpString="nointeractive") returned 13 [0120.592] _wcsicmp (_String1="nointeractive", _String2="\"NULL\"") returned 76 [0120.592] malloc (_Size=0x1c) returned 0x311ae50 [0120.592] malloc (_Size=0xc) returned 0x311a938 [0120.592] memmove_s (in: _Destination=0x311a938, _DestinationSize=0x8, _Source=0x3112cb8, _SourceSize=0x8 | out: _Destination=0x311a938) returned 0x0 [0120.592] free (_Block=0x3112cb8) [0120.592] free (_Block=0x0) [0120.592] free (_Block=0x311ae28) [0120.592] malloc (_Size=0xc) returned 0x311aad0 [0120.592] lstrlenW (lpString="QUIT") returned 4 [0120.592] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0120.592] lstrlenW (lpString="EXIT") returned 4 [0120.592] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0120.592] free (_Block=0x311aad0) [0120.592] WbemLocator:IUnknown:AddRef (This=0x2ce4640) returned 0x2 [0120.592] malloc (_Size=0xc) returned 0x311ab00 [0120.592] lstrlenW (lpString="/") returned 1 [0120.592] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0120.593] lstrlenW (lpString="-") returned 1 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0120.593] lstrlenW (lpString="CLASS") returned 5 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0120.593] lstrlenW (lpString="PATH") returned 4 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0120.593] lstrlenW (lpString="CONTEXT") returned 7 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] malloc (_Size=0x16) returned 0x3112ab8 [0120.593] lstrlenW (lpString="SHADOWCOPY") returned 10 [0120.593] GetCurrentThreadId () returned 0x440 [0120.593] ??0CHString@@QAE@XZ () returned 0x2c7f690 [0120.593] malloc (_Size=0xc) returned 0x311ab30 [0120.593] malloc (_Size=0xc) returned 0x311aad0 [0120.593] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2ce4640, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988540 | out: ppNamespace=0x988540*=0x2cea988) returned 0x0 [0122.079] free (_Block=0x311aad0) [0122.079] free (_Block=0x311ab30) [0122.079] CoSetProxyBlanket (pProxy=0x2cea988, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0122.079] ??1CHString@@QAE@XZ () returned 0x740265f8 [0122.080] GetCurrentThreadId () returned 0x440 [0122.080] ??0CHString@@QAE@XZ () returned 0x2c7f634 [0122.080] malloc (_Size=0xc) returned 0x311aad0 [0122.080] malloc (_Size=0xc) returned 0x311ab18 [0122.080] malloc (_Size=0xc) returned 0x311ab30 [0122.080] malloc (_Size=0xc) returned 0x311ac80 [0122.080] SysStringLen (param_1="root\\cli") returned 0x8 [0122.080] SysStringLen (param_1="\\") returned 0x1 [0122.080] malloc (_Size=0xc) returned 0x311abf0 [0122.080] SysStringLen (param_1="root\\cli\\") returned 0x9 [0122.080] SysStringLen (param_1="ms_409") returned 0x6 [0122.080] free (_Block=0x311ac80) [0122.080] free (_Block=0x311ab30) [0122.080] free (_Block=0x311ab18) [0122.080] free (_Block=0x311aad0) [0122.080] malloc (_Size=0xc) returned 0x311ab18 [0122.081] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2ce4640, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988544 | out: ppNamespace=0x988544*=0x2d18a90) returned 0x0 [0123.175] free (_Block=0x311ab18) [0123.176] free (_Block=0x311abf0) [0123.176] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.176] GetCurrentThreadId () returned 0x440 [0123.176] ??0CHString@@QAE@XZ () returned 0x2c7f690 [0123.176] malloc (_Size=0xc) returned 0x311ac20 [0123.176] malloc (_Size=0xc) returned 0x311ac68 [0123.176] malloc (_Size=0xc) returned 0x311ac80 [0123.176] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0123.176] malloc (_Size=0x3a) returned 0x311b5e8 [0123.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9414a8, cbMultiByte=-1, lpWideCharStr=0x311b5e8, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0123.176] free (_Block=0x311b5e8) [0123.176] malloc (_Size=0xc) returned 0x311ac98 [0123.176] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0123.176] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0123.176] malloc (_Size=0xc) returned 0x311ac38 [0123.176] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0123.176] SysStringLen (param_1="'") returned 0x1 [0123.177] free (_Block=0x311ac98) [0123.177] free (_Block=0x311ac80) [0123.177] free (_Block=0x311ac68) [0123.177] free (_Block=0x311ac20) [0123.177] IWbemServices:GetObject (in: This=0x2cea988, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0x2c7f68c*=0x0, ppCallResult=0x0 | out: ppObject=0x2c7f68c*=0x2d26998, ppCallResult=0x0) returned 0x0 [0123.189] malloc (_Size=0xc) returned 0x311ac50 [0123.190] IWbemClassObject:Get (in: This=0x2d26998, wszName="Target", lFlags=0, pVal=0x2c7f664*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f664*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.190] free (_Block=0x311ac50) [0123.190] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0123.190] malloc (_Size=0x3e) returned 0x311b5e8 [0123.190] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0123.190] malloc (_Size=0xc) returned 0x311ac98 [0123.190] IWbemClassObject:Get (in: This=0x2d26998, wszName="PWhere", lFlags=0, pVal=0x2c7f664*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f664*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.191] free (_Block=0x311ac98) [0123.191] lstrlenW (lpString=" Where ID = '#'") returned 15 [0123.191] malloc (_Size=0x20) returned 0x311ae28 [0123.191] lstrlenW (lpString=" Where ID = '#'") returned 15 [0123.191] malloc (_Size=0xc) returned 0x311ac20 [0123.191] IWbemClassObject:Get (in: This=0x2d26998, wszName="Connection", lFlags=0, pVal=0x2c7f664*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f664*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d26b30, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.191] free (_Block=0x311ac20) [0123.191] IUnknown:QueryInterface (in: This=0x2d26b30, riid=0x946a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2c7f680 | out: ppvObject=0x2c7f680*=0x2d26b30) returned 0x0 [0123.191] GetCurrentThreadId () returned 0x440 [0123.191] ??0CHString@@QAE@XZ () returned 0x2c7f5fc [0123.191] malloc (_Size=0xc) returned 0x311abf0 [0123.191] IWbemClassObject:Get (in: This=0x2d26b30, wszName="Namespace", lFlags=0, pVal=0x2c7f5e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.191] free (_Block=0x311abf0) [0123.191] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0123.191] malloc (_Size=0x16) returned 0x3112ad8 [0123.191] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0123.192] malloc (_Size=0xc) returned 0x311abf0 [0123.192] IWbemClassObject:Get (in: This=0x2d26b30, wszName="Locale", lFlags=0, pVal=0x2c7f5e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d10b04, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.192] free (_Block=0x311abf0) [0123.192] lstrlenW (lpString="ms_409") returned 6 [0123.192] malloc (_Size=0xe) returned 0x311ac50 [0123.192] lstrlenW (lpString="ms_409") returned 6 [0123.192] malloc (_Size=0xc) returned 0x311ac68 [0123.192] IWbemClassObject:Get (in: This=0x2d26b30, wszName="User", lFlags=0, pVal=0x2c7f5e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d10b04, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.192] free (_Block=0x311ac68) [0123.192] malloc (_Size=0xc) returned 0x311ac98 [0123.192] IWbemClassObject:Get (in: This=0x2d26b30, wszName="Password", lFlags=0, pVal=0x2c7f5e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.192] free (_Block=0x311ac98) [0123.192] malloc (_Size=0xc) returned 0x311ac68 [0123.192] IWbemClassObject:Get (in: This=0x2d26b30, wszName="Server", lFlags=0, pVal=0x2c7f5e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.192] free (_Block=0x311ac68) [0123.192] lstrlenW (lpString=".") returned 1 [0123.192] malloc (_Size=0x4) returned 0x3112cb8 [0123.192] lstrlenW (lpString=".") returned 1 [0123.193] malloc (_Size=0xc) returned 0x311ac68 [0123.193] IWbemClassObject:Get (in: This=0x2d26b30, wszName="Authority", lFlags=0, pVal=0x2c7f5e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d10b04, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.193] free (_Block=0x311ac68) [0123.193] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.193] IUnknown:Release (This=0x2d26b30) returned 0x1 [0123.193] GetCurrentThreadId () returned 0x440 [0123.193] ??0CHString@@QAE@XZ () returned 0x2c7f5f0 [0123.193] malloc (_Size=0xc) returned 0x311ac68 [0123.193] IWbemClassObject:Get (in: This=0x2d26998, wszName="__RELPATH", lFlags=0, pVal=0x2c7f5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.193] free (_Block=0x311ac68) [0123.193] malloc (_Size=0xc) returned 0x311ac20 [0123.193] GetCurrentThreadId () returned 0x440 [0123.193] ??0CHString@@QAE@XZ () returned 0x2c7f56c [0123.193] ??0CHString@@QAE@PBG@Z () returned 0x2c7f560 [0123.193] ??0CHString@@QAE@ABV0@@Z () returned 0x2c7f4e8 [0123.193] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0123.193] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x311b630 [0123.193] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0123.194] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2c7f4e0 [0123.194] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2c7f4e4 [0123.194] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2c7f560 [0123.194] ??1CHString@@QAE@XZ () returned 0x1 [0123.194] ??1CHString@@QAE@XZ () returned 0x1 [0123.194] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2c7f4dc [0123.194] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2c7f4e8 [0123.194] ??1CHString@@QAE@XZ () returned 0x1 [0123.194] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x311b698 [0123.194] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0123.194] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2c7f4e0 [0123.194] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2c7f4e4 [0123.194] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2c7f560 [0123.194] ??1CHString@@QAE@XZ () returned 0x1 [0123.194] ??1CHString@@QAE@XZ () returned 0x1 [0123.194] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2c7f4dc [0123.194] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2c7f4e8 [0123.194] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.194] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x740265ec [0123.194] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.194] malloc (_Size=0xc) returned 0x311ac08 [0123.194] malloc (_Size=0xc) returned 0x311ac68 [0123.194] malloc (_Size=0xc) returned 0x311acb0 [0123.194] malloc (_Size=0xc) returned 0x311ac80 [0123.194] malloc (_Size=0xc) returned 0x311ac98 [0123.194] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0123.194] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0123.194] malloc (_Size=0xc) returned 0x311abf0 [0123.195] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0123.195] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0123.195] malloc (_Size=0xc) returned 0x311ab18 [0123.195] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0123.195] SysStringLen (param_1="\"") returned 0x1 [0123.195] free (_Block=0x311abf0) [0123.195] free (_Block=0x311ac98) [0123.195] free (_Block=0x311ac80) [0123.195] free (_Block=0x311acb0) [0123.195] free (_Block=0x311ac68) [0123.195] free (_Block=0x311ac08) [0123.195] IWbemServices:GetObject (in: This=0x2d18a90, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x2c7f57c*=0x0, ppCallResult=0x0 | out: ppObject=0x2c7f57c*=0x2d27090, ppCallResult=0x0) returned 0x0 [0123.197] malloc (_Size=0xc) returned 0x311ac80 [0123.197] IWbemClassObject:Get (in: This=0x2d27090, wszName="Text", lFlags=0, pVal=0x2c7f544*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2c7f544*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d198c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2d038b8, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0123.198] free (_Block=0x311ac80) [0123.198] SafeArrayGetLBound (in: psa=0x2d198c0, nDim=0x1, plLbound=0x2c7f558 | out: plLbound=0x2c7f558) returned 0x0 [0123.198] SafeArrayGetUBound (in: psa=0x2d198c0, nDim=0x1, plUbound=0x2c7f554 | out: plUbound=0x2c7f554) returned 0x0 [0123.198] SafeArrayGetElement (in: psa=0x2d198c0, rgIndices=0x2c7f570, pv=0x2c7f568 | out: pv=0x2c7f568) returned 0x0 [0123.198] malloc (_Size=0xc) returned 0x311ac68 [0123.198] malloc (_Size=0xc) returned 0x311ac98 [0123.198] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0123.198] free (_Block=0x311ac68) [0123.198] IUnknown:Release (This=0x2d27090) returned 0x0 [0123.198] free (_Block=0x311ab18) [0123.198] ??1CHString@@QAE@XZ () returned 0x1 [0123.198] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.198] free (_Block=0x311ac20) [0123.198] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.198] lstrlenW (lpString="Shadow copy management.") returned 23 [0123.198] malloc (_Size=0x30) returned 0x311b630 [0123.198] lstrlenW (lpString="Shadow copy management.") returned 23 [0123.198] free (_Block=0x311ac98) [0123.198] IUnknown:Release (This=0x2d26998) returned 0x0 [0123.199] free (_Block=0x311ac38) [0123.199] ??1CHString@@QAE@XZ () returned 0x740265f8 [0123.199] lstrlenW (lpString="PATH") returned 4 [0123.199] lstrlenW (lpString="/") returned 1 [0123.199] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="PATH", cchCount2=4) returned 1 [0123.199] lstrlenW (lpString="WHERE") returned 5 [0123.199] lstrlenW (lpString="/") returned 1 [0123.199] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="WHERE", cchCount2=5) returned 1 [0123.199] lstrlenW (lpString="(") returned 1 [0123.199] lstrlenW (lpString="/") returned 1 [0123.199] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="(", cchCount2=1) returned 3 [0123.199] lstrlenW (lpString="/") returned 1 [0123.199] lstrlenW (lpString="/") returned 1 [0123.199] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0123.199] lstrlenW (lpString="?") returned 1 [0123.199] lstrlenW (lpString="nointeractive") returned 13 [0123.199] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="nointeractive", cchCount1=13, lpString2="?", cchCount2=1) returned 3 [0123.199] free (_Block=0x311ab00) [0123.199] GetCurrentThreadId () returned 0x440 [0123.199] ??0CHString@@QAE@PBG@Z () returned 0x2c7f72c [0123.199] ??YCHString@@QAEABV0@PBG@Z () returned 0x2c7f72c [0123.199] malloc (_Size=0x800) returned 0x311b6f0 [0123.200] LoadStringW (in: hInstance=0x0, uID=0xac5c, lpBuffer=0x311b6f0, cchBufferMax=1024 | out: lpBuffer="Unexpected switch at this level.\r\n") returned 0x22 [0123.200] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0123.200] malloc (_Size=0x23) returned 0x311bef8 [0123.200] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x311bef8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Unexpected switch at this level.\r\n", lpUsedDefaultChar=0x0) returned 35 [0123.200] __iob_func () returned 0x776f2608 [0123.200] fprintf (in: _File=0x776f2648, _Format="%s" | out: _File=0x776f2648) returned 34 [0123.450] __iob_func () returned 0x776f2608 [0123.450] fflush (in: _File=0x776f2648 | out: _File=0x776f2648) returned 0 [0123.450] free (_Block=0x311bef8) [0123.450] free (_Block=0x311b6f0) [0123.450] ??1CHString@@QAE@XZ () returned 0x1 [0123.450] ??0CHString@@QAE@PBG@Z () returned 0x2c7f734 [0123.450] ??YCHString@@QAEABV0@PBG@Z () returned 0x2c7f734 [0123.450] GetCurrentThreadId () returned 0x440 [0123.450] GetLastError () returned 0x0 [0123.450] ??1CHString@@QAE@XZ () returned 0x1 [0123.450] free (_Block=0x311aab8) [0123.451] free (_Block=0x311a9c8) [0123.451] free (_Block=0x311a8f0) [0123.451] free (_Block=0x311a998) [0123.451] free (_Block=0x311ada8) [0123.451] free (_Block=0x3112ab8) [0123.451] free (_Block=0x311b630) [0123.451] free (_Block=0x311b5e8) [0123.451] free (_Block=0x311ac50) [0123.451] free (_Block=0x3112ad8) [0123.451] free (_Block=0x3112cb8) [0123.451] free (_Block=0x31104f0) [0123.451] free (_Block=0x311ae28) [0123.451] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0123.451] free (_Block=0x311ade8) [0123.451] free (_Block=0x31129b8) [0123.451] free (_Block=0x3112ca8) [0123.451] free (_Block=0x311ae50) [0123.451] free (_Block=0x3112598) [0123.451] free (_Block=0x31125e0) [0123.451] free (_Block=0x3112628) [0123.451] free (_Block=0x31111a8) [0123.451] free (_Block=0x31126c0) [0123.451] free (_Block=0x3112c90) [0123.451] free (_Block=0x3112c58) [0123.451] free (_Block=0x3112c78) [0123.451] free (_Block=0x3112bf8) [0123.451] free (_Block=0x31104d8) [0123.451] free (_Block=0x3112898) [0123.452] free (_Block=0x3112800) [0123.452] free (_Block=0x3112818) [0123.452] free (_Block=0x31127c8) [0123.452] free (_Block=0x31127e0) [0123.452] free (_Block=0x3112838) [0123.452] free (_Block=0x3112850) [0123.452] free (_Block=0x31104a0) [0123.452] free (_Block=0x31104b8) [0123.452] free (_Block=0x3112758) [0123.452] free (_Block=0x3112770) [0123.452] free (_Block=0x3112720) [0123.452] free (_Block=0x3112738) [0123.452] free (_Block=0x3112790) [0123.452] free (_Block=0x31127a8) [0123.452] free (_Block=0x31126e8) [0123.452] free (_Block=0x3112700) [0123.452] free (_Block=0x3112698) [0123.452] free (_Block=0x3112670) [0123.452] free (_Block=0x311ad20) [0123.452] WbemLocator:IUnknown:Release (This=0x2d18a90) returned 0x0 [0123.454] WbemLocator:IUnknown:Release (This=0x2cea988) returned 0x0 [0123.455] WbemLocator:IUnknown:Release (This=0x2ce4640) returned 0x1 [0123.455] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0123.455] WbemLocator:IUnknown:Release (This=0x2ce4640) returned 0x0 [0123.455] free (_Block=0x311abc0) [0123.455] free (_Block=0x311aaa0) [0123.455] free (_Block=0x3112bb8) [0123.455] free (_Block=0x311aa70) [0123.455] free (_Block=0x311a968) [0123.455] free (_Block=0x3112918) [0123.455] free (_Block=0x311ab48) [0123.455] free (_Block=0x311aa10) [0123.455] free (_Block=0x3112978) [0123.455] free (_Block=0x311aa28) [0123.455] free (_Block=0x311ab60) [0123.455] free (_Block=0x3112b38) [0123.455] free (_Block=0x311a950) [0123.455] free (_Block=0x311aae8) [0123.455] free (_Block=0x3112b98) [0123.455] free (_Block=0x311a980) [0123.455] free (_Block=0x311a908) [0123.455] free (_Block=0x3112a38) [0123.455] free (_Block=0x311ab78) [0123.456] free (_Block=0x311aba8) [0123.456] free (_Block=0x3112a98) [0123.456] free (_Block=0x311aa40) [0123.456] free (_Block=0x311aa58) [0123.456] free (_Block=0x3112958) [0123.456] free (_Block=0x3119538) [0123.456] free (_Block=0x311a9e0) [0123.456] free (_Block=0x31128f8) [0123.456] free (_Block=0x311a9f8) [0123.456] free (_Block=0x311aa88) [0123.456] free (_Block=0x3112a18) [0123.456] free (_Block=0x311a9b0) [0123.456] free (_Block=0x311abd8) [0123.456] free (_Block=0x3112a58) [0123.456] free (_Block=0x311a920) [0123.456] free (_Block=0x311ab90) [0123.456] free (_Block=0x3112998) [0123.456] free (_Block=0x31196b8) [0123.456] free (_Block=0x3119580) [0123.457] free (_Block=0x3112c38) [0123.457] free (_Block=0x3119628) [0123.457] free (_Block=0x3119550) [0123.457] free (_Block=0x3112c18) [0123.457] free (_Block=0x3119610) [0123.457] free (_Block=0x31195c8) [0123.457] free (_Block=0x3112b18) [0123.457] free (_Block=0x3119688) [0123.457] free (_Block=0x31195f8) [0123.457] free (_Block=0x3112a78) [0123.457] free (_Block=0x31194f0) [0123.457] free (_Block=0x3119598) [0123.457] free (_Block=0x3112938) [0123.457] free (_Block=0x31195e0) [0123.457] free (_Block=0x3119640) [0123.457] free (_Block=0x31129d8) [0123.457] free (_Block=0x3119670) [0123.457] free (_Block=0x3119658) [0123.457] free (_Block=0x31128b8) [0123.457] free (_Block=0x31196a0) [0123.457] free (_Block=0x3119568) [0123.457] free (_Block=0x31128d8) [0123.457] free (_Block=0x3119508) [0123.458] free (_Block=0x3119520) [0123.458] free (_Block=0x31129f8) [0123.458] CoUninitialize () [0124.277] exit (_Code=44124) [0124.277] free (_Block=0x311acc8) [0124.277] free (_Block=0x3110ff8) [0124.277] ??1CHString@@QAE@XZ () returned 0x740265f8 [0124.277] free (_Block=0x3110538) [0124.277] free (_Block=0x31126d8) [0124.277] free (_Block=0x3110fd8) [0124.277] free (_Block=0x3110fb8) [0124.277] free (_Block=0x3110f88) [0124.277] free (_Block=0x3110f68) [0124.277] free (_Block=0x3110f38) [0124.277] free (_Block=0x3110ef8) [0124.277] free (_Block=0x3110ed8) [0124.277] ??1CHString@@QAE@XZ () returned 0x740265f8 [0124.277] free (_Block=0x311a938) Thread: id = 167 os_tid = 0xe4c Thread: id = 169 os_tid = 0xf60 Thread: id = 170 os_tid = 0xf9c Thread: id = 171 os_tid = 0x12dc Process: id = "13" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x15e79000" os_pid = "0xf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xe54" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 164 os_tid = 0x6e0 Thread: id = 165 os_tid = 0xed0 Thread: id = 166 os_tid = 0xf2c Process: id = "14" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x3d254000" os_pid = "0x133c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 191 os_tid = 0x132c Thread: id = 195 os_tid = 0x1374 Thread: id = 197 os_tid = 0x13a8 Thread: id = 198 os_tid = 0x117c Thread: id = 199 os_tid = 0x10a8 Process: id = "15" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1e339000" os_pid = "0x137c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x133c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 192 os_tid = 0x1338 Thread: id = 193 os_tid = 0x12f8 Thread: id = 194 os_tid = 0x1370 Process: id = "16" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x205d7000" os_pid = "0x13bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "wmic.exe SHADOWCOPY /nointeractive" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 204 os_tid = 0x13cc [0128.504] GetModuleHandleA (lpModuleName=0x0) returned 0x940000 [0128.504] __set_app_type (_Type=0x1) [0128.504] __p__fmode () returned 0x776f3c14 [0128.504] __p__commode () returned 0x776f49ec [0128.504] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x979af0) returned 0x0 [0128.504] __wgetmainargs (in: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0, _DoWildCard=0, _StartInfo=0x9881bc | out: _Argc=0x9881a8, _Argv=0x9881ac, _Env=0x9881b0) returned 0 [0128.505] ??0CHString@@QAE@XZ () returned 0x9885ec [0128.505] malloc (_Size=0x18) returned 0x3260ed8 [0128.505] malloc (_Size=0x38) returned 0x3260ef8 [0128.505] malloc (_Size=0x28) returned 0x3260f38 [0128.505] malloc (_Size=0x18) returned 0x3260f68 [0128.505] malloc (_Size=0x24) returned 0x3260f88 [0128.505] malloc (_Size=0x18) returned 0x3260fb8 [0128.505] malloc (_Size=0x18) returned 0x3260fd8 [0128.505] ??0CHString@@QAE@XZ () returned 0x9888fc [0128.505] malloc (_Size=0x18) returned 0x3260ff8 [0128.505] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0128.505] SetConsoleCtrlHandler (HandlerRoutine=0x973cc0, Add=1) returned 1 [0128.505] _onexit (_Func=0x97f370) returned 0x97f370 [0128.506] _onexit (_Func=0x97f380) returned 0x97f380 [0128.506] _onexit (_Func=0x97f390) returned 0x97f390 [0128.506] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.506] ResolveDelayLoadedAPI () returned 0x74a22590 [0128.506] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0128.512] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0129.583] CoCreateInstance (in: rclsid=0x946a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x988510 | out: ppv=0x988510*=0x2ff6690) returned 0x0 [0129.619] GetCurrentProcess () returned 0xffffffff [0129.619] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2ccf79c | out: TokenHandle=0x2ccf79c*=0x1a0) returned 1 [0129.619] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2ccf798 | out: TokenInformation=0x0, ReturnLength=0x2ccf798) returned 0 [0129.619] malloc (_Size=0x118) returned 0x3262598 [0129.619] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x3262598, TokenInformationLength=0x118, ReturnLength=0x2ccf798 | out: TokenInformation=0x3262598, ReturnLength=0x2ccf798) returned 1 [0129.619] AdjustTokenPrivileges (in: TokenHandle=0x1a0, DisableAllPrivileges=0, NewState=0x3262598*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.619] free (_Block=0x3262598) [0129.619] CloseHandle (hObject=0x1a0) returned 1 [0129.619] malloc (_Size=0x40) returned 0x3262598 [0129.619] malloc (_Size=0x40) returned 0x32625e0 [0129.619] malloc (_Size=0x40) returned 0x3262628 [0129.620] SetThreadUILanguage (LangId=0x0) returned 0x2bb0409 [0129.653] _vsnwprintf (in: _Buffer=0x3262628, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x2ccf724 | out: _Buffer="ms_409") returned 6 [0129.653] malloc (_Size=0x20) returned 0x3262670 [0129.653] GetComputerNameW (in: lpBuffer=0x3262670, nSize=0x2ccf788 | out: lpBuffer="NQDPDE", nSize=0x2ccf788) returned 1 [0129.653] lstrlenW (lpString="NQDPDE") returned 6 [0129.653] malloc (_Size=0xe) returned 0x32611a8 [0129.653] lstrlenW (lpString="NQDPDE") returned 6 [0129.653] ResolveDelayLoadedAPI () returned 0x7444db00 [0129.654] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x2ccf79c | out: lpNameBuffer=0x0, nSize=0x2ccf79c) returned 0x2bbf000 [0129.655] GetLastError () returned 0xea [0129.655] malloc (_Size=0x1e) returned 0x3262698 [0129.655] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3262698, nSize=0x2ccf79c | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x2ccf79c) returned 0x1 [0129.656] lstrlenW (lpString="") returned 0 [0129.656] lstrlenW (lpString="NQDPDE") returned 6 [0129.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0129.657] lstrlenW (lpString=".") returned 1 [0129.657] lstrlenW (lpString="NQDPDE") returned 6 [0129.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0129.657] lstrlenW (lpString="LOCALHOST") returned 9 [0129.657] lstrlenW (lpString="NQDPDE") returned 6 [0129.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0129.657] lstrlenW (lpString="NQDPDE") returned 6 [0129.657] lstrlenW (lpString="NQDPDE") returned 6 [0129.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0129.657] free (_Block=0x32611a8) [0129.657] lstrlenW (lpString="NQDPDE") returned 6 [0129.658] malloc (_Size=0xe) returned 0x32611a8 [0129.658] lstrlenW (lpString="NQDPDE") returned 6 [0129.658] lstrlenW (lpString="NQDPDE") returned 6 [0129.658] malloc (_Size=0xe) returned 0x32626c0 [0129.658] lstrlenW (lpString="NQDPDE") returned 6 [0129.658] malloc (_Size=0x4) returned 0x32626d8 [0129.658] malloc (_Size=0xc) returned 0x32626e8 [0129.658] ResolveDelayLoadedAPI () returned 0x7745b870 [0129.669] malloc (_Size=0x18) returned 0x3262700 [0129.669] malloc (_Size=0xc) returned 0x3262720 [0129.669] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.669] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.669] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.669] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.669] malloc (_Size=0x18) returned 0x3262738 [0129.669] malloc (_Size=0xc) returned 0x3262758 [0129.669] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.669] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.669] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.670] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.670] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.670] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.670] malloc (_Size=0x18) returned 0x3262770 [0129.670] malloc (_Size=0xc) returned 0x3262790 [0129.670] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.670] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.670] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.670] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.670] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.670] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.670] malloc (_Size=0x18) returned 0x32627a8 [0129.670] malloc (_Size=0xc) returned 0x32627c8 [0129.670] malloc (_Size=0x18) returned 0x32627e0 [0129.670] malloc (_Size=0xc) returned 0x3262800 [0129.670] SysStringLen (param_1="NONE") returned 0x4 [0129.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.670] SysStringLen (param_1="NONE") returned 0x4 [0129.670] malloc (_Size=0x18) returned 0x3262818 [0129.670] malloc (_Size=0xc) returned 0x3262838 [0129.670] SysStringLen (param_1="CONNECT") returned 0x7 [0129.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.670] malloc (_Size=0x18) returned 0x3262850 [0129.670] malloc (_Size=0xc) returned 0x32604a0 [0129.671] SysStringLen (param_1="CALL") returned 0x4 [0129.671] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.671] SysStringLen (param_1="CALL") returned 0x4 [0129.671] SysStringLen (param_1="CONNECT") returned 0x7 [0129.671] malloc (_Size=0x18) returned 0x32604b8 [0129.671] malloc (_Size=0xc) returned 0x32604d8 [0129.671] SysStringLen (param_1="PKT") returned 0x3 [0129.671] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.671] SysStringLen (param_1="PKT") returned 0x3 [0129.671] SysStringLen (param_1="NONE") returned 0x4 [0129.671] SysStringLen (param_1="NONE") returned 0x4 [0129.671] SysStringLen (param_1="PKT") returned 0x3 [0129.671] malloc (_Size=0x18) returned 0x32628b8 [0129.671] malloc (_Size=0xc) returned 0x3262c78 [0129.671] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.671] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.671] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.671] SysStringLen (param_1="NONE") returned 0x4 [0129.671] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.671] SysStringLen (param_1="PKT") returned 0x3 [0129.672] SysStringLen (param_1="PKT") returned 0x3 [0129.672] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.672] malloc (_Size=0x18) returned 0x32628d8 [0129.672] malloc (_Size=0xc) returned 0x3262c90 [0129.672] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.672] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.672] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.672] SysStringLen (param_1="PKT") returned 0x3 [0129.672] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.672] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.672] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.672] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.672] malloc (_Size=0x18) returned 0x3262ab8 [0129.672] malloc (_Size=0x40) returned 0x32604f0 [0129.672] malloc (_Size=0x20a) returned 0x32694c8 [0129.672] GetSystemDirectoryW (in: lpBuffer=0x32694c8, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.672] free (_Block=0x32694c8) [0129.672] malloc (_Size=0xc) returned 0x3262ca8 [0129.672] malloc (_Size=0xc) returned 0x3260538 [0129.672] malloc (_Size=0xc) returned 0x3260550 [0129.672] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0129.672] SysStringLen (param_1="\\wbem\\") returned 0x6 [0129.672] free (_Block=0x3262ca8) [0129.672] free (_Block=0x3260538) [0129.672] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0129.673] free (_Block=0x3260550) [0129.673] malloc (_Size=0xc) returned 0x32695b0 [0129.673] malloc (_Size=0xc) returned 0x3269508 [0129.673] malloc (_Size=0xc) returned 0x3269628 [0129.673] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0129.673] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0129.673] free (_Block=0x32695b0) [0129.673] free (_Block=0x3269508) [0129.673] GetCurrentThreadId () returned 0x13cc [0129.673] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x2ccf2ac | out: phkResult=0x2ccf2ac*=0x1ac) returned 0x0 [0129.673] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x2ccf2b8, lpcbData=0x2ccf2b4*=0x400 | out: lpType=0x0, lpData=0x2ccf2b8*=0x30, lpcbData=0x2ccf2b4*=0x4) returned 0x0 [0129.673] _wcsicmp (_String1="0", _String2="1") returned -1 [0129.673] _wcsicmp (_String1="0", _String2="2") returned -2 [0129.673] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2ccf2b4*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x2ccf2b4*=0x42) returned 0x0 [0129.673] malloc (_Size=0x86) returned 0x32696d0 [0129.673] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x32696d0, lpcbData=0x2ccf2b4*=0x42 | out: lpType=0x0, lpData=0x32696d0*=0x25, lpcbData=0x2ccf2b4*=0x42) returned 0x0 [0129.673] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0129.673] malloc (_Size=0x42) returned 0x3260538 [0129.673] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0129.673] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x2ccf2b8, lpcbData=0x2ccf2b4*=0x400 | out: lpType=0x0, lpData=0x2ccf2b8*=0x36, lpcbData=0x2ccf2b4*=0xc) returned 0x0 [0129.674] _wtol (_String="65536") returned 65536 [0129.674] free (_Block=0x32696d0) [0129.674] RegCloseKey (hKey=0x0) returned 0x6 [0129.674] CoCreateInstance (in: rclsid=0x946ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x946ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x2ccf748 | out: ppv=0x2ccf748*=0x2f645a8) returned 0x0 [0129.689] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x2f645a8, xmlSource=0x2ccf6cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x2ccf734 | out: isSuccessful=0x2ccf734*=0xffff) returned 0x0 [0129.865] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x2f645a8, DOMElement=0x2ccf744 | out: DOMElement=0x2ccf744) returned 0x0 [0129.866] malloc (_Size=0xc) returned 0x32695b0 [0129.866] free (_Block=0x32695b0) [0129.867] malloc (_Size=0xc) returned 0x3269670 [0129.867] free (_Block=0x3269670) [0129.867] malloc (_Size=0xc) returned 0x3269640 [0129.867] malloc (_Size=0xc) returned 0x3269520 [0129.867] malloc (_Size=0x18) returned 0x32628f8 [0129.867] malloc (_Size=0xc) returned 0x32695b0 [0129.867] free (_Block=0x32695b0) [0129.867] malloc (_Size=0xc) returned 0x32695f8 [0129.868] malloc (_Size=0xc) returned 0x3269550 [0129.868] SysStringLen (param_1="VALUE") returned 0x5 [0129.868] SysStringLen (param_1="TABLE") returned 0x5 [0129.868] SysStringLen (param_1="TABLE") returned 0x5 [0129.868] SysStringLen (param_1="VALUE") returned 0x5 [0129.868] malloc (_Size=0x18) returned 0x3262918 [0129.868] malloc (_Size=0xc) returned 0x3269610 [0129.868] free (_Block=0x3269610) [0129.868] malloc (_Size=0xc) returned 0x3269670 [0129.868] malloc (_Size=0xc) returned 0x3269688 [0129.868] SysStringLen (param_1="LIST") returned 0x4 [0129.868] SysStringLen (param_1="TABLE") returned 0x5 [0129.868] malloc (_Size=0x18) returned 0x3262a58 [0129.869] malloc (_Size=0xc) returned 0x3269538 [0129.869] free (_Block=0x3269538) [0129.869] malloc (_Size=0xc) returned 0x3269508 [0129.869] malloc (_Size=0xc) returned 0x3269598 [0129.869] SysStringLen (param_1="RAWXML") returned 0x6 [0129.869] SysStringLen (param_1="TABLE") returned 0x5 [0129.869] SysStringLen (param_1="RAWXML") returned 0x6 [0129.869] SysStringLen (param_1="LIST") returned 0x4 [0129.869] SysStringLen (param_1="LIST") returned 0x4 [0129.869] SysStringLen (param_1="RAWXML") returned 0x6 [0129.869] malloc (_Size=0x18) returned 0x3262bd8 [0129.869] malloc (_Size=0xc) returned 0x3269658 [0129.870] free (_Block=0x3269658) [0129.870] malloc (_Size=0xc) returned 0x3269610 [0129.870] malloc (_Size=0xc) returned 0x3269580 [0129.870] SysStringLen (param_1="HTABLE") returned 0x6 [0129.870] SysStringLen (param_1="TABLE") returned 0x5 [0129.870] SysStringLen (param_1="HTABLE") returned 0x6 [0129.870] SysStringLen (param_1="LIST") returned 0x4 [0129.870] malloc (_Size=0x18) returned 0x32629b8 [0129.870] malloc (_Size=0xc) returned 0x3269538 [0129.870] free (_Block=0x3269538) [0129.870] malloc (_Size=0xc) returned 0x32695b0 [0129.870] malloc (_Size=0xc) returned 0x32695e0 [0129.870] SysStringLen (param_1="HFORM") returned 0x5 [0129.870] SysStringLen (param_1="TABLE") returned 0x5 [0129.870] SysStringLen (param_1="HFORM") returned 0x5 [0129.871] SysStringLen (param_1="LIST") returned 0x4 [0129.871] SysStringLen (param_1="HFORM") returned 0x5 [0129.871] SysStringLen (param_1="HTABLE") returned 0x6 [0129.871] malloc (_Size=0x18) returned 0x3262af8 [0129.871] malloc (_Size=0xc) returned 0x3269658 [0129.871] free (_Block=0x3269658) [0129.871] malloc (_Size=0xc) returned 0x3269658 [0129.871] malloc (_Size=0xc) returned 0x32695c8 [0129.871] SysStringLen (param_1="XML") returned 0x3 [0129.871] SysStringLen (param_1="TABLE") returned 0x5 [0129.871] SysStringLen (param_1="XML") returned 0x3 [0129.871] SysStringLen (param_1="VALUE") returned 0x5 [0129.871] SysStringLen (param_1="VALUE") returned 0x5 [0129.871] SysStringLen (param_1="XML") returned 0x3 [0129.871] malloc (_Size=0x18) returned 0x3262998 [0129.872] malloc (_Size=0xc) returned 0x3269538 [0129.872] free (_Block=0x3269538) [0129.872] malloc (_Size=0xc) returned 0x32694f0 [0129.872] malloc (_Size=0xc) returned 0x32696a0 [0129.872] SysStringLen (param_1="MOF") returned 0x3 [0129.872] SysStringLen (param_1="TABLE") returned 0x5 [0129.872] SysStringLen (param_1="MOF") returned 0x3 [0129.872] SysStringLen (param_1="LIST") returned 0x4 [0129.872] SysStringLen (param_1="MOF") returned 0x3 [0129.872] SysStringLen (param_1="RAWXML") returned 0x6 [0129.872] SysStringLen (param_1="LIST") returned 0x4 [0129.872] SysStringLen (param_1="MOF") returned 0x3 [0129.872] malloc (_Size=0x18) returned 0x3262ad8 [0129.872] malloc (_Size=0xc) returned 0x32696b8 [0129.873] free (_Block=0x32696b8) [0129.873] malloc (_Size=0xc) returned 0x32696b8 [0129.873] malloc (_Size=0xc) returned 0x3269538 [0129.873] SysStringLen (param_1="CSV") returned 0x3 [0129.873] SysStringLen (param_1="TABLE") returned 0x5 [0129.873] SysStringLen (param_1="CSV") returned 0x3 [0129.873] SysStringLen (param_1="LIST") returned 0x4 [0129.873] SysStringLen (param_1="CSV") returned 0x3 [0129.873] SysStringLen (param_1="HTABLE") returned 0x6 [0129.873] SysStringLen (param_1="CSV") returned 0x3 [0129.873] SysStringLen (param_1="HFORM") returned 0x5 [0129.873] malloc (_Size=0x18) returned 0x3262938 [0129.873] malloc (_Size=0xc) returned 0x3269568 [0129.873] free (_Block=0x3269568) [0129.873] malloc (_Size=0xc) returned 0x3269568 [0129.873] malloc (_Size=0xc) returned 0x326aa88 [0129.874] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.874] SysStringLen (param_1="TABLE") returned 0x5 [0129.874] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.874] SysStringLen (param_1="VALUE") returned 0x5 [0129.874] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.874] SysStringLen (param_1="XML") returned 0x3 [0129.874] SysStringLen (param_1="XML") returned 0x3 [0129.874] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.874] malloc (_Size=0x18) returned 0x3262b18 [0129.874] malloc (_Size=0xc) returned 0x326a908 [0129.874] free (_Block=0x326a908) [0129.874] malloc (_Size=0xc) returned 0x326aab8 [0129.874] malloc (_Size=0xc) returned 0x326aae8 [0129.874] SysStringLen (param_1="texttablewsys") returned 0xd [0129.874] SysStringLen (param_1="TABLE") returned 0x5 [0129.874] SysStringLen (param_1="texttablewsys") returned 0xd [0129.874] SysStringLen (param_1="XML") returned 0x3 [0129.874] SysStringLen (param_1="texttablewsys") returned 0xd [0129.874] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.875] SysStringLen (param_1="XML") returned 0x3 [0129.875] SysStringLen (param_1="texttablewsys") returned 0xd [0129.875] malloc (_Size=0x18) returned 0x3262958 [0129.875] malloc (_Size=0xc) returned 0x326aa28 [0129.875] free (_Block=0x326aa28) [0129.875] malloc (_Size=0xc) returned 0x326a920 [0129.875] malloc (_Size=0xc) returned 0x326ab00 [0129.875] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.875] SysStringLen (param_1="TABLE") returned 0x5 [0129.875] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.875] SysStringLen (param_1="XML") returned 0x3 [0129.875] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.875] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.875] malloc (_Size=0x18) returned 0x3262b38 [0129.876] malloc (_Size=0xc) returned 0x326a968 [0129.876] free (_Block=0x326a968) [0129.876] malloc (_Size=0xc) returned 0x326aaa0 [0129.876] malloc (_Size=0xc) returned 0x326a9c8 [0129.876] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.876] SysStringLen (param_1="TABLE") returned 0x5 [0129.876] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.876] SysStringLen (param_1="XML") returned 0x3 [0129.876] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.876] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.876] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.876] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.876] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.876] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.876] malloc (_Size=0x18) returned 0x3262a98 [0129.877] malloc (_Size=0xc) returned 0x326a908 [0129.934] free (_Block=0x326a908) [0129.934] malloc (_Size=0xc) returned 0x326a980 [0129.934] malloc (_Size=0xc) returned 0x326aa58 [0129.934] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.934] SysStringLen (param_1="TABLE") returned 0x5 [0129.934] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.934] SysStringLen (param_1="XML") returned 0x3 [0129.934] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.934] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.934] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.934] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.934] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.934] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.934] malloc (_Size=0x18) returned 0x3262c38 [0129.935] malloc (_Size=0xc) returned 0x326a938 [0129.935] free (_Block=0x326a938) [0129.935] malloc (_Size=0xc) returned 0x326abd8 [0129.935] malloc (_Size=0xc) returned 0x326aad0 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] SysStringLen (param_1="TABLE") returned 0x5 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] SysStringLen (param_1="XML") returned 0x3 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.935] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.935] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.935] malloc (_Size=0x18) returned 0x3262bb8 [0129.936] malloc (_Size=0xc) returned 0x326ab18 [0129.936] free (_Block=0x326ab18) [0129.936] malloc (_Size=0xc) returned 0x326a908 [0129.936] malloc (_Size=0xc) returned 0x326a938 [0129.936] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.936] SysStringLen (param_1="TABLE") returned 0x5 [0129.936] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.936] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.936] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.936] SysStringLen (param_1="XML") returned 0x3 [0129.936] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.936] SysStringLen (param_1="texttablewsys") returned 0xd [0129.936] SysStringLen (param_1="XML") returned 0x3 [0129.936] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.936] malloc (_Size=0x18) returned 0x3262978 [0129.936] malloc (_Size=0xc) returned 0x326abc0 [0129.937] free (_Block=0x326abc0) [0129.937] malloc (_Size=0xc) returned 0x326aa40 [0129.937] malloc (_Size=0xc) returned 0x326a9e0 [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] SysStringLen (param_1="TABLE") returned 0x5 [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] SysStringLen (param_1="XML") returned 0x3 [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] SysStringLen (param_1="texttablewsys") returned 0xd [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.937] SysStringLen (param_1="XML") returned 0x3 [0129.937] SysStringLen (param_1="htable-sortby") returned 0xd [0129.937] malloc (_Size=0x18) returned 0x32629d8 [0129.937] malloc (_Size=0xc) returned 0x326a9f8 [0129.937] free (_Block=0x326a9f8) [0129.938] malloc (_Size=0xc) returned 0x326a9b0 [0129.938] malloc (_Size=0xc) returned 0x326a998 [0129.938] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.938] SysStringLen (param_1="TABLE") returned 0x5 [0129.938] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.938] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.938] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.938] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.938] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.938] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.938] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.938] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.938] malloc (_Size=0x18) returned 0x3262b98 [0129.938] malloc (_Size=0xc) returned 0x326a9f8 [0129.938] free (_Block=0x326a9f8) [0129.938] malloc (_Size=0xc) returned 0x326a9f8 [0129.938] malloc (_Size=0xc) returned 0x326aa10 [0129.938] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] SysStringLen (param_1="TABLE") returned 0x5 [0129.939] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.939] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.939] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.939] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.939] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.939] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.939] malloc (_Size=0x18) returned 0x32629f8 [0129.939] malloc (_Size=0xc) returned 0x326ab30 [0129.939] free (_Block=0x326ab30) [0129.939] malloc (_Size=0xc) returned 0x326aa28 [0129.939] malloc (_Size=0xc) returned 0x326aa70 [0129.940] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.940] SysStringLen (param_1="TABLE") returned 0x5 [0129.940] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.940] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.940] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.940] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.940] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.940] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.940] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.940] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.940] malloc (_Size=0x18) returned 0x3262c58 [0129.940] malloc (_Size=0xc) returned 0x326ab18 [0129.940] free (_Block=0x326ab18) [0129.940] malloc (_Size=0xc) returned 0x326ab18 [0129.940] malloc (_Size=0xc) returned 0x326ab30 [0129.940] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.940] SysStringLen (param_1="TABLE") returned 0x5 [0129.940] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.940] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.940] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.940] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.941] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.941] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.941] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.941] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.941] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.941] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.941] malloc (_Size=0x18) returned 0x3262c18 [0129.941] FreeThreadedDOMDocument:IUnknown:Release (This=0x2f645a8) returned 0x0 [0129.941] free (_Block=0x3269628) [0129.941] GetCommandLineW () returned="wmic.exe SHADOWCOPY /nointeractive" [0129.941] malloc (_Size=0x50) returned 0x326acc8 [0129.941] memcpy_s (in: _Destination=0x326acc8, _DestinationSize=0x4e, _Source=0x2fe1aa8, _SourceSize=0x44 | out: _Destination=0x326acc8) returned 0x0 [0129.941] malloc (_Size=0xc) returned 0x326ab48 [0129.941] malloc (_Size=0xc) returned 0x326ab60 [0129.941] malloc (_Size=0xc) returned 0x326a968 [0129.941] malloc (_Size=0xc) returned 0x326ab78 [0129.942] malloc (_Size=0x80) returned 0x326ad20 [0129.942] GetLocalTime (in: lpSystemTime=0x2ccf6f8 | out: lpSystemTime=0x2ccf6f8*(wYear=0x7e4, wMonth=0xa, wDayOfWeek=0x0, wDay=0x4, wHour=0x12, wMinute=0x25, wSecond=0x1e, wMilliseconds=0xf8)) [0129.942] _vsnwprintf (in: _Buffer=0x326ad20, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x2ccf6d8 | out: _Buffer="10-04-2020T18:37:30") returned 19 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] malloc (_Size=0x36) returned 0x326ada8 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] malloc (_Size=0x36) returned 0x326ade8 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] malloc (_Size=0x16) returned 0x3262a18 [0129.942] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.942] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0129.942] malloc (_Size=0x16) returned 0x3262a38 [0129.942] malloc (_Size=0x4) returned 0x3260588 [0129.942] free (_Block=0x0) [0129.942] free (_Block=0x3262a18) [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] malloc (_Size=0x4) returned 0x3260598 [0129.942] lstrlenW (lpString="/") returned 1 [0129.942] malloc (_Size=0x4) returned 0x3262ca8 [0129.942] malloc (_Size=0x8) returned 0x3262cb8 [0129.942] memmove_s (in: _Destination=0x3262cb8, _DestinationSize=0x4, _Source=0x3260588, _SourceSize=0x4 | out: _Destination=0x3262cb8) returned 0x0 [0129.942] free (_Block=0x3260588) [0129.942] free (_Block=0x0) [0129.942] free (_Block=0x3260598) [0129.942] lstrlenW (lpString=" SHADOWCOPY /nointeractive") returned 26 [0129.942] malloc (_Size=0x1c) returned 0x326ae28 [0129.942] lstrlenW (lpString="nointeractive") returned 13 [0129.942] _wcsicmp (_String1="nointeractive", _String2="\"NULL\"") returned 76 [0129.942] malloc (_Size=0x1c) returned 0x326ae50 [0129.942] malloc (_Size=0xc) returned 0x326ab90 [0129.943] memmove_s (in: _Destination=0x326ab90, _DestinationSize=0x8, _Source=0x3262cb8, _SourceSize=0x8 | out: _Destination=0x326ab90) returned 0x0 [0129.943] free (_Block=0x3262cb8) [0129.943] free (_Block=0x0) [0129.943] free (_Block=0x326ae28) [0129.943] malloc (_Size=0xc) returned 0x326a950 [0129.943] lstrlenW (lpString="QUIT") returned 4 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0129.943] lstrlenW (lpString="EXIT") returned 4 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0129.943] free (_Block=0x326a950) [0129.943] WbemLocator:IUnknown:AddRef (This=0x2ff6690) returned 0x2 [0129.943] malloc (_Size=0xc) returned 0x326aba8 [0129.943] lstrlenW (lpString="/") returned 1 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0129.943] lstrlenW (lpString="-") returned 1 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0129.943] lstrlenW (lpString="CLASS") returned 5 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0129.943] lstrlenW (lpString="PATH") returned 4 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0129.943] lstrlenW (lpString="CONTEXT") returned 7 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] malloc (_Size=0x16) returned 0x3262a18 [0129.943] lstrlenW (lpString="SHADOWCOPY") returned 10 [0129.943] GetCurrentThreadId () returned 0x13cc [0129.944] ??0CHString@@QAE@XZ () returned 0x2ccf650 [0129.944] malloc (_Size=0xc) returned 0x326a950 [0129.944] malloc (_Size=0xc) returned 0x326abc0 [0129.944] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2ff6690, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988540 | out: ppNamespace=0x988540*=0x2ffabd0) returned 0x0 [0130.402] free (_Block=0x326abc0) [0130.402] free (_Block=0x326a950) [0130.402] CoSetProxyBlanket (pProxy=0x2ffabd0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0130.402] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.402] GetCurrentThreadId () returned 0x13cc [0130.402] ??0CHString@@QAE@XZ () returned 0x2ccf5f4 [0130.402] malloc (_Size=0xc) returned 0x326a8f0 [0130.402] malloc (_Size=0xc) returned 0x326abc0 [0130.402] malloc (_Size=0xc) returned 0x326a950 [0130.402] malloc (_Size=0xc) returned 0x326ac20 [0130.402] SysStringLen (param_1="root\\cli") returned 0x8 [0130.402] SysStringLen (param_1="\\") returned 0x1 [0130.402] malloc (_Size=0xc) returned 0x326abf0 [0130.402] SysStringLen (param_1="root\\cli\\") returned 0x9 [0130.402] SysStringLen (param_1="ms_409") returned 0x6 [0130.403] free (_Block=0x326ac20) [0130.403] free (_Block=0x326a950) [0130.403] free (_Block=0x326abc0) [0130.403] free (_Block=0x326a8f0) [0130.403] malloc (_Size=0xc) returned 0x326a950 [0130.403] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2ff6690, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x988544 | out: ppNamespace=0x988544*=0x3028320) returned 0x0 [0130.716] free (_Block=0x326a950) [0130.716] free (_Block=0x326abf0) [0130.716] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.716] GetCurrentThreadId () returned 0x13cc [0130.716] ??0CHString@@QAE@XZ () returned 0x2ccf650 [0130.716] malloc (_Size=0xc) returned 0x326abf0 [0130.716] malloc (_Size=0xc) returned 0x326ac20 [0130.716] malloc (_Size=0xc) returned 0x326ac08 [0130.716] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0130.717] malloc (_Size=0x3a) returned 0x326b5e8 [0130.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9414a8, cbMultiByte=-1, lpWideCharStr=0x326b5e8, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0130.717] free (_Block=0x326b5e8) [0130.717] malloc (_Size=0xc) returned 0x326ac98 [0130.717] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0130.717] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0130.717] malloc (_Size=0xc) returned 0x326ac38 [0130.717] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0130.717] SysStringLen (param_1="'") returned 0x1 [0130.717] free (_Block=0x326ac98) [0130.717] free (_Block=0x326ac08) [0130.717] free (_Block=0x326ac20) [0130.717] free (_Block=0x326abf0) [0130.717] IWbemServices:GetObject (in: This=0x2ffabd0, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0x2ccf64c*=0x0, ppCallResult=0x0 | out: ppObject=0x2ccf64c*=0x30378c0, ppCallResult=0x0) returned 0x0 [0130.735] malloc (_Size=0xc) returned 0x326ac08 [0130.735] IWbemClassObject:Get (in: This=0x30378c0, wszName="Target", lFlags=0, pVal=0x2ccf624*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf624*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.736] free (_Block=0x326ac08) [0130.736] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.736] malloc (_Size=0x3e) returned 0x326b5e8 [0130.736] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.736] malloc (_Size=0xc) returned 0x326ac68 [0130.736] IWbemClassObject:Get (in: This=0x30378c0, wszName="PWhere", lFlags=0, pVal=0x2ccf624*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf624*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.736] free (_Block=0x326ac68) [0130.736] lstrlenW (lpString=" Where ID = '#'") returned 15 [0130.736] malloc (_Size=0x20) returned 0x326ae28 [0130.752] lstrlenW (lpString=" Where ID = '#'") returned 15 [0130.753] malloc (_Size=0xc) returned 0x326ac50 [0130.753] IWbemClassObject:Get (in: This=0x30378c0, wszName="Connection", lFlags=0, pVal=0x2ccf624*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf624*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3037a58, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.753] free (_Block=0x326ac50) [0130.753] IUnknown:QueryInterface (in: This=0x3037a58, riid=0x946a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2ccf640 | out: ppvObject=0x2ccf640*=0x3037a58) returned 0x0 [0130.753] GetCurrentThreadId () returned 0x13cc [0130.753] ??0CHString@@QAE@XZ () returned 0x2ccf5bc [0130.753] malloc (_Size=0xc) returned 0x326ac08 [0130.753] IWbemClassObject:Get (in: This=0x3037a58, wszName="Namespace", lFlags=0, pVal=0x2ccf5a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.753] free (_Block=0x326ac08) [0130.753] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0130.753] malloc (_Size=0x16) returned 0x3262a78 [0130.753] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0130.753] malloc (_Size=0xc) returned 0x326ac98 [0130.754] IWbemClassObject:Get (in: This=0x3037a58, wszName="Locale", lFlags=0, pVal=0x2ccf5a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3020b34, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.754] free (_Block=0x326ac98) [0130.754] lstrlenW (lpString="ms_409") returned 6 [0130.754] malloc (_Size=0xe) returned 0x326ac50 [0130.754] lstrlenW (lpString="ms_409") returned 6 [0130.754] malloc (_Size=0xc) returned 0x326acb0 [0130.754] IWbemClassObject:Get (in: This=0x3037a58, wszName="User", lFlags=0, pVal=0x2ccf5a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3020b34, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.754] free (_Block=0x326acb0) [0130.754] malloc (_Size=0xc) returned 0x326ac68 [0130.754] IWbemClassObject:Get (in: This=0x3037a58, wszName="Password", lFlags=0, pVal=0x2ccf5a4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.754] free (_Block=0x326ac68) [0130.754] malloc (_Size=0xc) returned 0x326ac68 [0130.754] IWbemClassObject:Get (in: This=0x3037a58, wszName="Server", lFlags=0, pVal=0x2ccf5a4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.754] free (_Block=0x326ac68) [0130.755] lstrlenW (lpString=".") returned 1 [0130.755] malloc (_Size=0x4) returned 0x3262cb8 [0130.755] lstrlenW (lpString=".") returned 1 [0130.755] malloc (_Size=0xc) returned 0x326ac68 [0130.755] IWbemClassObject:Get (in: This=0x3037a58, wszName="Authority", lFlags=0, pVal=0x2ccf5a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3020b34, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf5a4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.755] free (_Block=0x326ac68) [0130.755] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.755] IUnknown:Release (This=0x3037a58) returned 0x1 [0130.755] GetCurrentThreadId () returned 0x13cc [0130.755] ??0CHString@@QAE@XZ () returned 0x2ccf5b0 [0130.755] malloc (_Size=0xc) returned 0x326ac80 [0130.755] IWbemClassObject:Get (in: This=0x30378c0, wszName="__RELPATH", lFlags=0, pVal=0x2ccf598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.755] free (_Block=0x326ac80) [0130.755] malloc (_Size=0xc) returned 0x326abf0 [0130.755] GetCurrentThreadId () returned 0x13cc [0130.756] ??0CHString@@QAE@XZ () returned 0x2ccf52c [0130.756] ??0CHString@@QAE@PBG@Z () returned 0x2ccf520 [0130.756] ??0CHString@@QAE@ABV0@@Z () returned 0x2ccf4a8 [0130.756] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0130.756] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x326b630 [0130.756] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0130.756] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2ccf4a0 [0130.756] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2ccf4a4 [0130.756] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2ccf520 [0130.756] ??1CHString@@QAE@XZ () returned 0x1 [0130.756] ??1CHString@@QAE@XZ () returned 0x1 [0130.756] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2ccf49c [0130.756] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2ccf4a8 [0130.756] ??1CHString@@QAE@XZ () returned 0x1 [0130.756] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x326b698 [0130.756] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0130.756] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2ccf4a0 [0130.756] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2ccf4a4 [0130.756] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2ccf520 [0130.756] ??1CHString@@QAE@XZ () returned 0x1 [0130.756] ??1CHString@@QAE@XZ () returned 0x1 [0130.756] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2ccf49c [0130.756] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2ccf4a8 [0130.756] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.756] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x740265ec [0130.756] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.756] malloc (_Size=0xc) returned 0x326acb0 [0130.757] malloc (_Size=0xc) returned 0x326ac68 [0130.757] malloc (_Size=0xc) returned 0x326ac08 [0130.757] malloc (_Size=0xc) returned 0x326ac98 [0130.757] malloc (_Size=0xc) returned 0x326ac20 [0130.757] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0130.757] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0130.757] malloc (_Size=0xc) returned 0x326ac80 [0130.757] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0130.757] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0130.757] malloc (_Size=0xc) returned 0x326abc0 [0130.757] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0130.757] SysStringLen (param_1="\"") returned 0x1 [0130.757] free (_Block=0x326ac80) [0130.757] free (_Block=0x326ac20) [0130.757] free (_Block=0x326ac98) [0130.758] free (_Block=0x326ac08) [0130.758] free (_Block=0x326ac68) [0130.758] free (_Block=0x326acb0) [0130.758] IWbemServices:GetObject (in: This=0x3028320, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x2ccf53c*=0x0, ppCallResult=0x0 | out: ppObject=0x2ccf53c*=0x3037fb8, ppCallResult=0x0) returned 0x0 [0130.761] malloc (_Size=0xc) returned 0x326ac20 [0130.761] IWbemClassObject:Get (in: This=0x3037fb8, wszName="Text", lFlags=0, pVal=0x2ccf504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2ccf504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x302a818*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2ffb8b8, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.761] free (_Block=0x326ac20) [0130.761] SafeArrayGetLBound (in: psa=0x302a818, nDim=0x1, plLbound=0x2ccf518 | out: plLbound=0x2ccf518) returned 0x0 [0130.762] SafeArrayGetUBound (in: psa=0x302a818, nDim=0x1, plUbound=0x2ccf514 | out: plUbound=0x2ccf514) returned 0x0 [0130.762] SafeArrayGetElement (in: psa=0x302a818, rgIndices=0x2ccf530, pv=0x2ccf528 | out: pv=0x2ccf528) returned 0x0 [0130.762] malloc (_Size=0xc) returned 0x326ac80 [0130.762] malloc (_Size=0xc) returned 0x326ac68 [0130.762] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0130.762] free (_Block=0x326ac80) [0130.762] IUnknown:Release (This=0x3037fb8) returned 0x0 [0130.762] free (_Block=0x326abc0) [0130.762] ??1CHString@@QAE@XZ () returned 0x1 [0130.762] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.762] free (_Block=0x326abf0) [0130.762] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.762] lstrlenW (lpString="Shadow copy management.") returned 23 [0130.762] malloc (_Size=0x30) returned 0x326b630 [0130.762] lstrlenW (lpString="Shadow copy management.") returned 23 [0130.762] free (_Block=0x326ac68) [0130.762] IUnknown:Release (This=0x30378c0) returned 0x0 [0130.763] free (_Block=0x326ac38) [0130.763] ??1CHString@@QAE@XZ () returned 0x740265f8 [0130.763] lstrlenW (lpString="PATH") returned 4 [0130.763] lstrlenW (lpString="/") returned 1 [0130.763] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="PATH", cchCount2=4) returned 1 [0130.763] lstrlenW (lpString="WHERE") returned 5 [0130.763] lstrlenW (lpString="/") returned 1 [0130.763] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="WHERE", cchCount2=5) returned 1 [0130.763] lstrlenW (lpString="(") returned 1 [0130.763] lstrlenW (lpString="/") returned 1 [0130.763] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="(", cchCount2=1) returned 3 [0130.763] lstrlenW (lpString="/") returned 1 [0130.763] lstrlenW (lpString="/") returned 1 [0130.763] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0130.763] lstrlenW (lpString="?") returned 1 [0130.763] lstrlenW (lpString="nointeractive") returned 13 [0130.763] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="nointeractive", cchCount1=13, lpString2="?", cchCount2=1) returned 3 [0130.763] free (_Block=0x326aba8) [0130.763] GetCurrentThreadId () returned 0x13cc [0130.763] ??0CHString@@QAE@PBG@Z () returned 0x2ccf6ec [0130.763] ??YCHString@@QAEABV0@PBG@Z () returned 0x2ccf6ec [0130.763] malloc (_Size=0x800) returned 0x326b6f0 [0130.763] LoadStringW (in: hInstance=0x0, uID=0xac5c, lpBuffer=0x326b6f0, cchBufferMax=1024 | out: lpBuffer="Unexpected switch at this level.\r\n") returned 0x22 [0130.764] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0130.764] malloc (_Size=0x23) returned 0x326bef8 [0130.764] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Unexpected switch at this level.\r\n", cchWideChar=-1, lpMultiByteStr=0x326bef8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Unexpected switch at this level.\r\n", lpUsedDefaultChar=0x0) returned 35 [0130.764] __iob_func () returned 0x776f2608 [0130.764] fprintf (in: _File=0x776f2648, _Format="%s" | out: _File=0x776f2648) returned 34 [0130.870] __iob_func () returned 0x776f2608 [0130.870] fflush (in: _File=0x776f2648 | out: _File=0x776f2648) returned 0 [0130.870] free (_Block=0x326bef8) [0130.871] free (_Block=0x326b6f0) [0130.871] ??1CHString@@QAE@XZ () returned 0x1 [0130.871] ??0CHString@@QAE@PBG@Z () returned 0x2ccf6f4 [0130.871] ??YCHString@@QAEABV0@PBG@Z () returned 0x2ccf6f4 [0130.871] GetCurrentThreadId () returned 0x13cc [0130.871] GetLastError () returned 0x0 [0130.871] ??1CHString@@QAE@XZ () returned 0x1 [0130.871] free (_Block=0x326ab78) [0130.871] free (_Block=0x326a968) [0130.871] free (_Block=0x326ab60) [0130.871] free (_Block=0x326ab48) [0130.871] free (_Block=0x326ada8) [0130.871] free (_Block=0x3262a18) [0130.871] free (_Block=0x326b630) [0130.871] free (_Block=0x326b5e8) [0130.871] free (_Block=0x326ac50) [0130.871] free (_Block=0x3262a78) [0130.871] free (_Block=0x3262cb8) [0130.871] free (_Block=0x32604f0) [0130.871] free (_Block=0x326ae28) [0130.871] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0130.871] free (_Block=0x326ade8) [0130.871] free (_Block=0x3262a38) [0130.871] free (_Block=0x3262ca8) [0130.871] free (_Block=0x326ae50) [0130.871] free (_Block=0x3262598) [0130.871] free (_Block=0x32625e0) [0130.871] free (_Block=0x3262628) [0130.871] free (_Block=0x32611a8) [0130.871] free (_Block=0x32626c0) [0130.871] free (_Block=0x3262c90) [0130.871] free (_Block=0x3262ab8) [0130.872] free (_Block=0x3262c78) [0130.872] free (_Block=0x32628d8) [0130.872] free (_Block=0x32604d8) [0130.872] free (_Block=0x32628b8) [0130.872] free (_Block=0x3262800) [0130.872] free (_Block=0x3262818) [0130.872] free (_Block=0x32627c8) [0130.872] free (_Block=0x32627e0) [0130.872] free (_Block=0x3262838) [0130.872] free (_Block=0x3262850) [0130.872] free (_Block=0x32604a0) [0130.872] free (_Block=0x32604b8) [0130.872] free (_Block=0x3262758) [0130.872] free (_Block=0x3262770) [0130.872] free (_Block=0x3262720) [0130.872] free (_Block=0x3262738) [0130.872] free (_Block=0x3262790) [0130.872] free (_Block=0x32627a8) [0130.872] free (_Block=0x32626e8) [0130.872] free (_Block=0x3262700) [0130.872] free (_Block=0x3262698) [0130.872] free (_Block=0x3262670) [0130.872] free (_Block=0x326ad20) [0130.872] WbemLocator:IUnknown:Release (This=0x3028320) returned 0x0 [0130.873] WbemLocator:IUnknown:Release (This=0x2ffabd0) returned 0x0 [0130.873] WbemLocator:IUnknown:Release (This=0x2ff6690) returned 0x1 [0130.873] ?Empty@CHString@@QAEXXZ () returned 0x740265f8 [0130.873] WbemLocator:IUnknown:Release (This=0x2ff6690) returned 0x0 [0130.873] free (_Block=0x326aa28) [0130.874] free (_Block=0x326aa70) [0130.874] free (_Block=0x3262c58) [0130.874] free (_Block=0x326ab18) [0130.874] free (_Block=0x326ab30) [0130.874] free (_Block=0x3262c18) [0130.874] free (_Block=0x326a980) [0130.874] free (_Block=0x326aa58) [0130.874] free (_Block=0x3262c38) [0130.874] free (_Block=0x326abd8) [0130.874] free (_Block=0x326aad0) [0130.874] free (_Block=0x3262bb8) [0130.874] free (_Block=0x326a920) [0130.874] free (_Block=0x326ab00) [0130.874] free (_Block=0x3262b38) [0130.874] free (_Block=0x326aaa0) [0130.874] free (_Block=0x326a9c8) [0130.874] free (_Block=0x3262a98) [0130.874] free (_Block=0x326a9b0) [0130.874] free (_Block=0x326a998) [0130.874] free (_Block=0x3262b98) [0130.874] free (_Block=0x326a9f8) [0130.874] free (_Block=0x326aa10) [0130.874] free (_Block=0x32629f8) [0130.874] free (_Block=0x3269568) [0130.874] free (_Block=0x326aa88) [0130.874] free (_Block=0x3262b18) [0130.875] free (_Block=0x326aab8) [0130.875] free (_Block=0x326aae8) [0130.875] free (_Block=0x3262958) [0130.875] free (_Block=0x326a908) [0130.875] free (_Block=0x326a938) [0130.875] free (_Block=0x3262978) [0130.875] free (_Block=0x326aa40) [0130.875] free (_Block=0x326a9e0) [0130.875] free (_Block=0x32629d8) [0130.875] free (_Block=0x3269658) [0130.875] free (_Block=0x32695c8) [0130.875] free (_Block=0x3262998) [0130.875] free (_Block=0x32695f8) [0130.875] free (_Block=0x3269550) [0130.875] free (_Block=0x3262918) [0130.875] free (_Block=0x3269640) [0130.875] free (_Block=0x3269520) [0130.875] free (_Block=0x32628f8) [0130.875] free (_Block=0x3269508) [0130.875] free (_Block=0x3269598) [0130.875] free (_Block=0x3262bd8) [0130.875] free (_Block=0x32694f0) [0130.875] free (_Block=0x32696a0) [0130.875] free (_Block=0x3262ad8) [0130.875] free (_Block=0x3269670) [0130.876] free (_Block=0x3269688) [0130.876] free (_Block=0x3262a58) [0130.876] free (_Block=0x3269610) [0130.876] free (_Block=0x3269580) [0130.876] free (_Block=0x32629b8) [0130.876] free (_Block=0x32695b0) [0130.876] free (_Block=0x32695e0) [0130.876] free (_Block=0x3262af8) [0130.876] free (_Block=0x32696b8) [0130.876] free (_Block=0x3269538) [0130.876] free (_Block=0x3262938) [0130.876] CoUninitialize () [0131.120] exit (_Code=44124) [0131.121] free (_Block=0x326acc8) [0131.121] free (_Block=0x3260ff8) [0131.121] ??1CHString@@QAE@XZ () returned 0x740265f8 [0131.121] free (_Block=0x3260538) [0131.121] free (_Block=0x32626d8) [0131.121] free (_Block=0x3260fd8) [0131.121] free (_Block=0x3260fb8) [0131.121] free (_Block=0x3260f88) [0131.121] free (_Block=0x3260f68) [0131.121] free (_Block=0x3260f38) [0131.121] free (_Block=0x3260ef8) [0131.121] free (_Block=0x3260ed8) [0131.121] ??1CHString@@QAE@XZ () returned 0x740265f8 [0131.121] free (_Block=0x326ab90) Thread: id = 208 os_tid = 0xfd4 Thread: id = 209 os_tid = 0x378 Thread: id = 210 os_tid = 0x790 Thread: id = 211 os_tid = 0xd18 Process: id = "17" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x20671000" os_pid = "0x13b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x13bc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 205 os_tid = 0x13ac Thread: id = 206 os_tid = 0x1180 Thread: id = 207 os_tid = 0x10bc Process: id = "18" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x20fda000" os_pid = "0x10ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 212 os_tid = 0x10e0 Thread: id = 216 os_tid = 0xc2c Thread: id = 217 os_tid = 0xdbc Thread: id = 218 os_tid = 0xdd0 Thread: id = 219 os_tid = 0xb50 Process: id = "19" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2069e000" os_pid = "0x12d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x10ec" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 213 os_tid = 0xd84 Thread: id = 214 os_tid = 0xaac Thread: id = 215 os_tid = 0x2c0 Process: id = "20" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x29441000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "C:\\WINDOWS\\system32\\sc.exe start wuauserv" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 237 os_tid = 0xe8c [0210.889] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff724370000 [0210.890] __set_app_type (_Type=0x1) [0210.890] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7243722b0) returned 0x0 [0210.890] __wgetmainargs (in: _Argc=0x7ff724381028, _Argv=0x7ff724381030, _Env=0x7ff724381038, _DoWildCard=0, _StartInfo=0x7ff724381044 | out: _Argc=0x7ff724381028, _Argv=0x7ff724381030, _Env=0x7ff724381038) returned 0 [0210.890] SetThreadUILanguage (LangId=0x0) returned 0x409 [0215.681] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0215.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0215.682] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0215.682] _wcsicmp (_String1="start", _String2="query") returned 2 [0215.682] _wcsicmp (_String1="start", _String2="queryex") returned 2 [0215.682] _wcsicmp (_String1="start", _String2="start") returned 0 [0215.682] ResolveDelayLoadedAPI () returned 0x7ffce9434cf0 [0215.685] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1c9af0c85b0 [0215.690] OpenServiceW (hSCManager=0x1c9af0c85b0, lpServiceName="wuauserv", dwDesiredAccess=0x14) returned 0x1c9af0c6b30 [0215.691] StartServiceW (hService=0x1c9af0c6b30, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0215.745] GetLastError () returned 0x420 [0215.745] _ultow (in: _Dest=0x420, _Radix=1794570152 | out: _Dest=0x420) returned="1056" [0215.745] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x420, dwLanguageId=0x0, lpBuffer=0x7ff724381640, nSize=0x400, Arguments=0x0 | out: lpBuffer="An instance of the service is already running.\r\n") returned 0x30 [0215.746] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x9e6af6f760, nSize=0x2, Arguments=0x9e6af6f790 | out: lpBuffer="栀꼌lj") returned 0x54 [0222.997] GetFileType (hFile=0x50) returned 0x2 [0222.997] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9e6af6f710 | out: lpMode=0x9e6af6f710) returned 1 [0222.998] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x1c9af0c6800*, nNumberOfCharsToWrite=0x54, lpNumberOfCharsWritten=0x9e6af6f708, lpReserved=0x0 | out: lpBuffer=0x1c9af0c6800*, lpNumberOfCharsWritten=0x9e6af6f708*=0x54) returned 1 [0222.999] LocalFree (hMem=0x1c9af0c6800) returned 0x0 [0222.999] LocalFree (hMem=0x0) returned 0x0 [0222.999] CloseServiceHandle (hSCObject=0x1c9af0c6b30) returned 1 [0222.999] CloseServiceHandle (hSCObject=0x1c9af0c85b0) returned 1 [0223.000] LocalFree (hMem=0x0) returned 0x0 [0223.000] exit (_Code=1056) Thread: id = 636 os_tid = 0xe38 Thread: id = 638 os_tid = 0xe38 Thread: id = 639 os_tid = 0xe38 Process: id = "21" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x2c0a2000" os_pid = "0x1160" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 234 os_tid = 0xac0 Thread: id = 235 os_tid = 0x58c Thread: id = 236 os_tid = 0x12cc Thread: id = 238 os_tid = 0xeac Thread: id = 239 os_tid = 0x1004 Thread: id = 240 os_tid = 0x102c Process: id = "22" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x27a64000" os_pid = "0x2d4" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x368" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 241 os_tid = 0xe84 Thread: id = 242 os_tid = 0x1040 Thread: id = 250 os_tid = 0xe14 Thread: id = 251 os_tid = 0x1260 Thread: id = 252 os_tid = 0xfd0 Process: id = "23" image_name = "System" filename = "" page_root = "0x1aa000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "created_daemon" parent_id = "20" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 253 os_tid = 0x4c Thread: id = 254 os_tid = 0xc0 Thread: id = 255 os_tid = 0x1c Thread: id = 256 os_tid = 0x80 Thread: id = 257 os_tid = 0x10f0 Thread: id = 258 os_tid = 0xe8 Thread: id = 259 os_tid = 0x18 Thread: id = 260 os_tid = 0x126c Thread: id = 261 os_tid = 0x1274 Thread: id = 262 os_tid = 0x124 Thread: id = 263 os_tid = 0xfa4 Thread: id = 264 os_tid = 0x14 Thread: id = 265 os_tid = 0x128 Thread: id = 266 os_tid = 0xebc Thread: id = 267 os_tid = 0xe58 Thread: id = 268 os_tid = 0x0 Thread: id = 269 os_tid = 0x30 Thread: id = 270 os_tid = 0x188 Thread: id = 271 os_tid = 0x100 Thread: id = 272 os_tid = 0xb18 Thread: id = 273 os_tid = 0xb14 Thread: id = 274 os_tid = 0xa8 Thread: id = 275 os_tid = 0xa64 Thread: id = 276 os_tid = 0xc4 Thread: id = 277 os_tid = 0x84 Thread: id = 278 os_tid = 0x9dc Thread: id = 279 os_tid = 0x974 Thread: id = 280 os_tid = 0x8d0 Thread: id = 281 os_tid = 0x8b0 Thread: id = 282 os_tid = 0x848 Thread: id = 283 os_tid = 0x844 Thread: id = 284 os_tid = 0x82c Thread: id = 285 os_tid = 0x4d8 Thread: id = 286 os_tid = 0x10 Thread: id = 287 os_tid = 0x664 Thread: id = 288 os_tid = 0x644 Thread: id = 289 os_tid = 0x64 Thread: id = 290 os_tid = 0x5e0 Thread: id = 291 os_tid = 0x34 Thread: id = 292 os_tid = 0x4a4 Thread: id = 293 os_tid = 0x49c Thread: id = 294 os_tid = 0x40 Thread: id = 295 os_tid = 0x1b8 Thread: id = 296 os_tid = 0x6c Thread: id = 297 os_tid = 0xb0 Thread: id = 298 os_tid = 0x364 Thread: id = 299 os_tid = 0x2c Thread: id = 300 os_tid = 0x1b4 Thread: id = 301 os_tid = 0x8c Thread: id = 302 os_tid = 0x2f8 Thread: id = 303 os_tid = 0x68 Thread: id = 304 os_tid = 0x174 Thread: id = 305 os_tid = 0xfc Thread: id = 306 os_tid = 0x60 Thread: id = 307 os_tid = 0x164 Thread: id = 308 os_tid = 0x70 Thread: id = 309 os_tid = 0x74 Thread: id = 310 os_tid = 0x1f8 Thread: id = 311 os_tid = 0x13c Thread: id = 312 os_tid = 0x1bc Thread: id = 313 os_tid = 0x1b0 Thread: id = 314 os_tid = 0x1ac Thread: id = 315 os_tid = 0x1a8 Thread: id = 316 os_tid = 0x28 Thread: id = 317 os_tid = 0x130 Thread: id = 318 os_tid = 0xe4 Thread: id = 319 os_tid = 0x20 Thread: id = 320 os_tid = 0x54 Thread: id = 321 os_tid = 0xbc Thread: id = 322 os_tid = 0x180 Thread: id = 323 os_tid = 0xc8 Thread: id = 324 os_tid = 0xa4 Thread: id = 325 os_tid = 0x50 Thread: id = 326 os_tid = 0x11c Thread: id = 327 os_tid = 0x120 Thread: id = 328 os_tid = 0x15c Thread: id = 329 os_tid = 0x14c Thread: id = 330 os_tid = 0xb8 Thread: id = 331 os_tid = 0x148 Thread: id = 332 os_tid = 0x88 Thread: id = 333 os_tid = 0xb4 Thread: id = 334 os_tid = 0xec Thread: id = 335 os_tid = 0x8 Thread: id = 336 os_tid = 0xf0 Process: id = "24" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x56669000" os_pid = "0x23c" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "created_daemon" parent_id = "20" os_parent_pid = "0x1dc" cmd_line = "C:\\WINDOWS\\system32\\services.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 337 os_tid = 0x6ec Thread: id = 338 os_tid = 0x86c Thread: id = 339 os_tid = 0x854 Thread: id = 340 os_tid = 0x12c Thread: id = 341 os_tid = 0x3ec Thread: id = 342 os_tid = 0x3e8 Thread: id = 343 os_tid = 0x3e4 Thread: id = 344 os_tid = 0x3d4 Thread: id = 345 os_tid = 0x3d0 Thread: id = 346 os_tid = 0x3bc Thread: id = 347 os_tid = 0x328 Thread: id = 348 os_tid = 0x2fc Thread: id = 349 os_tid = 0x298 Thread: id = 350 os_tid = 0x294 Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75ed0000" os_pid = "0x2a4" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BrokerInfrastructure" [0xa], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\DeviceInstall" [0xa], "NT SERVICE\\LSM" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT SERVICE\\SystemEventsBroker" [0xa], "NT AUTHORITY\\Logon Session 00000000:00004ed0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 351 os_tid = 0x10f8 Thread: id = 352 os_tid = 0xb0c Thread: id = 353 os_tid = 0xa9c Thread: id = 354 os_tid = 0x9b4 Thread: id = 355 os_tid = 0x9a4 Thread: id = 356 os_tid = 0x99c Thread: id = 357 os_tid = 0x964 Thread: id = 358 os_tid = 0x960 Thread: id = 359 os_tid = 0x954 Thread: id = 360 os_tid = 0x948 Thread: id = 361 os_tid = 0x92c Thread: id = 362 os_tid = 0x918 Thread: id = 363 os_tid = 0x90c Thread: id = 364 os_tid = 0x75c Thread: id = 365 os_tid = 0x758 Thread: id = 366 os_tid = 0x638 Thread: id = 367 os_tid = 0x62c Thread: id = 368 os_tid = 0x40c Thread: id = 369 os_tid = 0x314 Thread: id = 370 os_tid = 0x2ec Thread: id = 371 os_tid = 0x3b4 Thread: id = 372 os_tid = 0x358 Thread: id = 373 os_tid = 0x354 Thread: id = 374 os_tid = 0x340 Thread: id = 375 os_tid = 0x32c Thread: id = 376 os_tid = 0x31c Thread: id = 377 os_tid = 0x30c Thread: id = 378 os_tid = 0x2f4 Thread: id = 379 os_tid = 0x2a8 Thread: id = 653 os_tid = 0x8dc Process: id = "26" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x74d18000" os_pid = "0x304" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:00008d78" [0xc000000f], "LOCAL" [0x7] Thread: id = 380 os_tid = 0x9ac Thread: id = 381 os_tid = 0x9a8 Thread: id = 382 os_tid = 0x950 Thread: id = 383 os_tid = 0x94c Thread: id = 384 os_tid = 0x93c Thread: id = 385 os_tid = 0x938 Thread: id = 386 os_tid = 0x934 Thread: id = 387 os_tid = 0x928 Thread: id = 388 os_tid = 0x924 Thread: id = 389 os_tid = 0x91c Thread: id = 390 os_tid = 0x640 Thread: id = 391 os_tid = 0x63c Thread: id = 392 os_tid = 0x630 Thread: id = 393 os_tid = 0x628 Thread: id = 394 os_tid = 0x3c8 Thread: id = 395 os_tid = 0x344 Thread: id = 396 os_tid = 0x338 Thread: id = 397 os_tid = 0x334 Thread: id = 398 os_tid = 0x324 Thread: id = 399 os_tid = 0x320 Thread: id = 400 os_tid = 0x318 Thread: id = 401 os_tid = 0x308 Process: id = "27" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x74331000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xa], "NT SERVICE\\CoreMessagingRegistrar" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\NcdAutoSetup" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f63" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 402 os_tid = 0xa60 Thread: id = 403 os_tid = 0xa5c Thread: id = 404 os_tid = 0xa58 Thread: id = 405 os_tid = 0xa34 Thread: id = 406 os_tid = 0xa1c Thread: id = 407 os_tid = 0xa18 Thread: id = 408 os_tid = 0x9f8 Thread: id = 409 os_tid = 0x8ec Thread: id = 410 os_tid = 0x8e8 Thread: id = 411 os_tid = 0x87c Thread: id = 412 os_tid = 0x870 Thread: id = 413 os_tid = 0x838 Thread: id = 414 os_tid = 0x834 Thread: id = 415 os_tid = 0x814 Thread: id = 416 os_tid = 0x7a8 Thread: id = 417 os_tid = 0x78c Thread: id = 418 os_tid = 0x7e0 Thread: id = 419 os_tid = 0x7f4 Thread: id = 420 os_tid = 0x694 Thread: id = 421 os_tid = 0x7d4 Thread: id = 422 os_tid = 0x7cc Thread: id = 423 os_tid = 0x7c8 Thread: id = 424 os_tid = 0x7c4 Thread: id = 425 os_tid = 0x65c Thread: id = 426 os_tid = 0x15c Thread: id = 427 os_tid = 0x3c4 Process: id = "28" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x738d0000" os_pid = "0x3d8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xa], "NT SERVICE\\TimeBroker" [0xa], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a38e" [0xc000000f], "LOCAL" [0x7] Thread: id = 428 os_tid = 0x1394 Thread: id = 429 os_tid = 0x138c Thread: id = 430 os_tid = 0x1320 Thread: id = 431 os_tid = 0x1344 Thread: id = 432 os_tid = 0xfa8 Thread: id = 433 os_tid = 0x12fc Thread: id = 434 os_tid = 0xf18 Thread: id = 435 os_tid = 0xf08 Thread: id = 436 os_tid = 0x54c Thread: id = 437 os_tid = 0x444 Thread: id = 438 os_tid = 0x418 Thread: id = 439 os_tid = 0x410 Thread: id = 440 os_tid = 0x35c Thread: id = 441 os_tid = 0x3f4 Thread: id = 442 os_tid = 0x3f0 Thread: id = 443 os_tid = 0x33c Thread: id = 444 os_tid = 0x238 Thread: id = 445 os_tid = 0x154 Thread: id = 446 os_tid = 0x3dc Process: id = "29" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x735ee000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xa], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\DeviceAssociationService" [0xa], "NT SERVICE\\DevQueryBroker" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\DsSvc" [0xa], "NT SERVICE\\fhsvc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\HvHost" [0xa], "S-1-5-80-2355113075-3359631449-3346493237-3667020425-1655874352" [0xa], "NT SERVICE\\irmon" [0xa], "NT SERVICE\\NcbService" [0xe], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\NgcSvc" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\ScDeviceEnum" [0xa], "NT SERVICE\\SensorService" [0xa], "NT SERVICE\\SmsRouter" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\svsvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\vmicguestinterface" [0xa], "NT SERVICE\\vmickvpexchange" [0xa], "NT SERVICE\\vmicshutdown" [0xa], "NT SERVICE\\vmicvmsession" [0xa], "NT SERVICE\\vmicvss" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\WiaRpc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a4e4" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 447 os_tid = 0x112c Thread: id = 448 os_tid = 0xe60 Thread: id = 449 os_tid = 0xe5c Thread: id = 450 os_tid = 0x898 Thread: id = 451 os_tid = 0x894 Thread: id = 452 os_tid = 0x890 Thread: id = 453 os_tid = 0x88c Thread: id = 454 os_tid = 0x878 Thread: id = 455 os_tid = 0x5ac Thread: id = 456 os_tid = 0x548 Thread: id = 457 os_tid = 0x540 Thread: id = 458 os_tid = 0x4e0 Thread: id = 459 os_tid = 0x4bc Thread: id = 460 os_tid = 0x290 Thread: id = 461 os_tid = 0x164 Thread: id = 462 os_tid = 0x3fc Thread: id = 637 os_tid = 0x11f0 Process: id = "30" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x566ab000" os_pid = "0x350" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xe], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "S-1-5-80-2226967063-754826275-1661302337-2802353169-2369347280" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b10d" [0xc000000f], "LOCAL" [0x7] Thread: id = 463 os_tid = 0x428 Thread: id = 464 os_tid = 0xcbc Thread: id = 465 os_tid = 0xc24 Thread: id = 466 os_tid = 0xc10 Thread: id = 467 os_tid = 0xc0c Thread: id = 468 os_tid = 0xc08 Thread: id = 469 os_tid = 0xc04 Thread: id = 470 os_tid = 0xbd0 Thread: id = 471 os_tid = 0x9dc Thread: id = 472 os_tid = 0x544 Thread: id = 473 os_tid = 0x6f4 Thread: id = 474 os_tid = 0xbcc Thread: id = 475 os_tid = 0x4dc Thread: id = 476 os_tid = 0x490 Thread: id = 477 os_tid = 0x4c4 Thread: id = 478 os_tid = 0x9d4 Thread: id = 479 os_tid = 0x8f4 Thread: id = 480 os_tid = 0x700 Thread: id = 481 os_tid = 0x538 Thread: id = 482 os_tid = 0x534 Thread: id = 483 os_tid = 0x530 Thread: id = 484 os_tid = 0x500 Thread: id = 485 os_tid = 0x4b8 Thread: id = 486 os_tid = 0x498 Thread: id = 487 os_tid = 0x47c Thread: id = 488 os_tid = 0x478 Thread: id = 489 os_tid = 0x474 Thread: id = 490 os_tid = 0x470 Thread: id = 491 os_tid = 0x46c Thread: id = 492 os_tid = 0x468 Thread: id = 493 os_tid = 0x448 Thread: id = 494 os_tid = 0x424 Thread: id = 495 os_tid = 0x420 Thread: id = 496 os_tid = 0x364 Process: id = "31" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x667bb000" os_pid = "0x434" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k NetworkService" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xa], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\NlaSvc" [0xe], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bd29" [0xc000000f], "LOCAL" [0x7] Thread: id = 497 os_tid = 0x524 Thread: id = 498 os_tid = 0xac8 Thread: id = 499 os_tid = 0x10c8 Thread: id = 500 os_tid = 0x10c4 Thread: id = 501 os_tid = 0x105c Thread: id = 502 os_tid = 0xfc8 Thread: id = 503 os_tid = 0xfc4 Thread: id = 504 os_tid = 0xf14 Thread: id = 505 os_tid = 0xef4 Thread: id = 506 os_tid = 0x6b8 Thread: id = 507 os_tid = 0x864 Thread: id = 508 os_tid = 0x674 Thread: id = 509 os_tid = 0x658 Thread: id = 510 os_tid = 0x4d4 Thread: id = 511 os_tid = 0x4d0 Thread: id = 512 os_tid = 0x4cc Thread: id = 513 os_tid = 0x4c8 Thread: id = 514 os_tid = 0x4c0 Thread: id = 515 os_tid = 0x494 Thread: id = 516 os_tid = 0x48c Thread: id = 517 os_tid = 0x488 Thread: id = 518 os_tid = 0x464 Thread: id = 519 os_tid = 0x45c Thread: id = 520 os_tid = 0x458 Thread: id = 521 os_tid = 0x454 Thread: id = 522 os_tid = 0x450 Thread: id = 523 os_tid = 0x438 Process: id = "32" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x57af0000" os_pid = "0x554" os_integrity_level = "0x4000" os_privileges = "0x20800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000ec56" [0xc000000f], "LOCAL" [0x7] Thread: id = 524 os_tid = 0x1334 Thread: id = 525 os_tid = 0x588 Thread: id = 526 os_tid = 0x584 Thread: id = 527 os_tid = 0x580 Thread: id = 528 os_tid = 0x57c Thread: id = 529 os_tid = 0x578 Thread: id = 530 os_tid = 0x574 Thread: id = 531 os_tid = 0x570 Thread: id = 532 os_tid = 0x558 Process: id = "33" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4f8fa000" os_pid = "0x590" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "S-1-5-80-4071458001-3563271761-1846288968-3700919931-3809667977" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000f41a" [0xc000000f], "LOCAL" [0x7] Thread: id = 533 os_tid = 0xcc0 Thread: id = 534 os_tid = 0xc30 Thread: id = 535 os_tid = 0x8e4 Thread: id = 536 os_tid = 0x8e0 Thread: id = 537 os_tid = 0x594 Process: id = "34" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4c27b000" os_pid = "0x598" os_integrity_level = "0x4000" os_privileges = "0x20800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Wcmsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000f421" [0xc000000f], "LOCAL" [0x7] Thread: id = 538 os_tid = 0x68c Thread: id = 539 os_tid = 0x66c Thread: id = 540 os_tid = 0x624 Thread: id = 541 os_tid = 0x614 Thread: id = 542 os_tid = 0x60c Thread: id = 543 os_tid = 0x608 Thread: id = 544 os_tid = 0x604 Thread: id = 545 os_tid = 0x600 Thread: id = 546 os_tid = 0x5d4 Thread: id = 547 os_tid = 0x59c Process: id = "35" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4c27d000" os_pid = "0x5b0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f8bc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 548 os_tid = 0x1124 Thread: id = 549 os_tid = 0x1120 Thread: id = 550 os_tid = 0x9bc Thread: id = 551 os_tid = 0x7ec Thread: id = 552 os_tid = 0x770 Thread: id = 553 os_tid = 0x7d8 Thread: id = 554 os_tid = 0x698 Thread: id = 555 os_tid = 0x690 Thread: id = 556 os_tid = 0x5fc Thread: id = 557 os_tid = 0x5f8 Thread: id = 558 os_tid = 0x5f4 Thread: id = 559 os_tid = 0x5b4 Process: id = "36" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x4ac0c000" os_pid = "0x5e8" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\spoolsv.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:0001010e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 560 os_tid = 0xffc Thread: id = 561 os_tid = 0x1230 Thread: id = 562 os_tid = 0x1228 Thread: id = 563 os_tid = 0x1224 Thread: id = 564 os_tid = 0x1214 Thread: id = 565 os_tid = 0x120c Thread: id = 566 os_tid = 0x1208 Thread: id = 567 os_tid = 0x1200 Thread: id = 568 os_tid = 0x11fc Thread: id = 569 os_tid = 0x634 Thread: id = 570 os_tid = 0x620 Thread: id = 571 os_tid = 0x618 Thread: id = 572 os_tid = 0x610 Thread: id = 573 os_tid = 0x5ec Process: id = "37" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4f046000" os_pid = "0x69c" os_integrity_level = "0x4000" os_privileges = "0x860814080" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k wsappx" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppXSvc" [0xe], "NT SERVICE\\ClipSVC" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001205b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 574 os_tid = 0x7d0 Thread: id = 575 os_tid = 0x6b4 Thread: id = 576 os_tid = 0x6b0 Thread: id = 577 os_tid = 0x6a8 Thread: id = 578 os_tid = 0x6a0 Thread: id = 651 os_tid = 0x12d0 Process: id = "38" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4dab9000" os_pid = "0x720" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k UnistackSvcGroup" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 579 os_tid = 0xd28 Thread: id = 580 os_tid = 0x900 Thread: id = 581 os_tid = 0xeb4 Thread: id = 582 os_tid = 0xed4 Thread: id = 583 os_tid = 0x1358 Thread: id = 584 os_tid = 0x1204 Thread: id = 585 os_tid = 0xcc4 Thread: id = 586 os_tid = 0x6d4 Thread: id = 587 os_tid = 0x74c Thread: id = 588 os_tid = 0x7dc Thread: id = 589 os_tid = 0x7b4 Thread: id = 590 os_tid = 0x76c Thread: id = 591 os_tid = 0x768 Thread: id = 592 os_tid = 0x754 Thread: id = 593 os_tid = 0x750 Thread: id = 594 os_tid = 0x748 Thread: id = 595 os_tid = 0x724 Process: id = "39" image_name = "officeclicktorun.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe" page_root = "0x465e2000" os_pid = "0x818" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe\" /service" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 596 os_tid = 0x122c Thread: id = 597 os_tid = 0x11b4 Thread: id = 598 os_tid = 0xf98 Thread: id = 599 os_tid = 0xf00 Thread: id = 600 os_tid = 0xe80 Thread: id = 601 os_tid = 0xe68 Thread: id = 602 os_tid = 0xb6c Thread: id = 603 os_tid = 0xa68 Thread: id = 604 os_tid = 0xa48 Thread: id = 605 os_tid = 0xa3c Thread: id = 606 os_tid = 0xa04 Thread: id = 607 os_tid = 0xa00 Thread: id = 608 os_tid = 0x9f4 Thread: id = 609 os_tid = 0x9f0 Thread: id = 610 os_tid = 0x9ec Thread: id = 611 os_tid = 0x9e4 Thread: id = 612 os_tid = 0x9c8 Thread: id = 613 os_tid = 0x858 Thread: id = 614 os_tid = 0x828 Thread: id = 615 os_tid = 0x81c Process: id = "40" image_name = "securityhealthservice.exe" filename = "c:\\windows\\system32\\securityhealthservice.exe" page_root = "0x4aae8000" os_pid = "0x84c" os_integrity_level = "0x4000" os_privileges = "0x20900080" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\SecurityHealthService.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "S-1-5-80-259296475-4084429506-1152984619-38739575-565535606" [0xe], "NT AUTHORITY\\Logon Session 00000000:000180f8" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 616 os_tid = 0x994 Thread: id = 617 os_tid = 0x990 Thread: id = 618 os_tid = 0x98c Thread: id = 619 os_tid = 0x8d4 Thread: id = 620 os_tid = 0x850 Process: id = "41" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x56533000" os_pid = "0x1024" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BthHFSrv" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xe], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:000529b0" [0xc000000f], "LOCAL" [0x7] Thread: id = 621 os_tid = 0x1068 Thread: id = 622 os_tid = 0x1060 Thread: id = 623 os_tid = 0x1058 Thread: id = 624 os_tid = 0x104c Thread: id = 625 os_tid = 0x1048 Thread: id = 626 os_tid = 0x1044 Thread: id = 627 os_tid = 0x1034 Thread: id = 628 os_tid = 0x1028 Process: id = "42" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x180cf000" os_pid = "0x1050" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\sppsvc.exe" cur_dir = "C:\\WINDOWS" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007576c" [0xc000000f], "LOCAL" [0x7] Thread: id = 629 os_tid = 0xe90 Thread: id = 630 os_tid = 0x113c [0299.700] GetProcessHeap () returned 0x17cd79e0000 [0299.700] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x230) returned 0x17cd8ba2320 [0299.700] GetProcessHeap () returned 0x17cd79e0000 [0299.700] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x28) returned 0x17cd8ad5df0 [0299.701] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.713] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe780, Length=0x50, ResultLength=0x0) [0299.713] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.713] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe780, Length=0x50, ResultLength=0x0) [0299.713] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe780, Length=0x50, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe670, Length=0x50, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe670, Length=0x50, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe670, Length=0x50, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe670, Length=0x50, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe5a0, Length=0x38, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3d0, Length=0x28, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3d0, Length=0x28, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3d0, Length=0x28, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3d0, Length=0x28, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe440, Length=0x28, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe5a0, Length=0x38, ResultLength=0x0) [0299.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe4c0, Length=0x28, ResultLength=0x0) [0299.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.720] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.720] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.720] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe4c0, Length=0x28, ResultLength=0x0) [0299.720] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe360, Length=0x20, ResultLength=0x0) [0299.720] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe2e0, Length=0x20, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe2e0, Length=0x20, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe2e0, Length=0x20, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.721] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe5a0, Length=0x38, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe5a0, Length=0x38, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe420, Length=0x20, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3b0, Length=0x20, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fe3b0, Length=0x20, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.722] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.723] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd5f0, Length=0x50, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd5f0, Length=0x50, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd5f0, Length=0x50, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd4e0, Length=0x50, ResultLength=0x0) [0299.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd4e0, Length=0x50, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd4e0, Length=0x50, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd4e0, Length=0x50, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e2fd410, Length=0x38, ResultLength=0x0) Thread: id = 631 os_tid = 0x738 Thread: id = 632 os_tid = 0x9d0 Thread: id = 633 os_tid = 0xd38 [0220.621] GetProcessHeap () returned 0x17cd79e0000 [0220.621] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x30) returned 0x17cd85dfa10 [0220.621] GetProcessHeap () returned 0x17cd79e0000 [0220.621] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x2d30) returned 0x17cd7a8af80 [0220.621] GetProcessHeap () returned 0x17cd79e0000 [0220.621] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd7a2f460 [0220.621] GetProcessHeap () returned 0x17cd79e0000 [0220.622] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd7a84450 [0220.622] GetProcessHeap () returned 0x17cd79e0000 [0220.622] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x2d1c) returned 0x17cd7a909f0 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a861c0 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a312e0 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a30640 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a845b0 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd85dfad0 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a58900 | out: hHeap=0x17cd79e0000) returned 1 [0220.623] GetProcessHeap () returned 0x17cd79e0000 [0220.623] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd87dc040 | out: hHeap=0x17cd79e0000) returned 1 [0220.625] GetProcessHeap () returned 0x17cd79e0000 [0220.625] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a8af80 | out: hHeap=0x17cd79e0000) returned 1 [0220.626] GetProcessHeap () returned 0x17cd79e0000 [0220.626] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a2f460 | out: hHeap=0x17cd79e0000) returned 1 [0220.626] GetProcessHeap () returned 0x17cd79e0000 [0220.626] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a84450 | out: hHeap=0x17cd79e0000) returned 1 [0220.626] GetProcessHeap () returned 0x17cd79e0000 [0220.626] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd85dfa10 | out: hHeap=0x17cd79e0000) returned 1 [0220.626] GetProcessHeap () returned 0x17cd79e0000 [0220.626] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a8dcc0 | out: hHeap=0x17cd79e0000) returned 1 [0220.627] GetProcessHeap () returned 0x17cd79e0000 [0220.627] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd79eb550 | out: hHeap=0x17cd79e0000) returned 1 [0220.627] GetProcessHeap () returned 0x17cd79e0000 [0220.627] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a909f0 | out: hHeap=0x17cd79e0000) returned 1 [0220.627] GetProcessHeap () returned 0x17cd79e0000 [0220.627] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a2f250 | out: hHeap=0x17cd79e0000) returned 1 [0220.627] GetProcessHeap () returned 0x17cd79e0000 [0220.627] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a845f0 | out: hHeap=0x17cd79e0000) returned 1 [0220.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0220.630] LocalAlloc (uFlags=0x0, uBytes=0x118) returned 0x17cd7a861c0 [0220.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0220.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbe0, Length=0x30, ResultLength=0x0) [0220.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db50, Length=0x30, ResultLength=0x0) [0220.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db50, Length=0x30, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] GetProcessHeap () returned 0x17cd79e0000 [0220.636] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2c) returned 0x17cd85dfa50 [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] GetProcessHeap () returned 0x17cd79e0000 [0220.640] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4d2e0 [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.642] GetProcessHeap () returned 0x17cd79e0000 [0220.642] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4dd60 [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.645] GetProcessHeap () returned 0x17cd79e0000 [0220.645] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x30) returned 0x17cd85dfad0 [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.649] GetProcessHeap () returned 0x17cd79e0000 [0220.649] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4c630 [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] GetProcessHeap () returned 0x17cd79e0000 [0220.652] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x76) returned 0x17cd7a757c0 [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.654] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.655] GetProcessHeap () returned 0x17cd79e0000 [0220.655] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x30) returned 0x17cd85dfcd0 [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.656] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.659] GetProcessHeap () returned 0x17cd79e0000 [0220.659] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x30) returned 0x17cd7a877c0 [0220.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.661] GetProcessHeap () returned 0x17cd79e0000 [0220.661] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4df20 [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.665] GetProcessHeap () returned 0x17cd79e0000 [0220.666] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x4e) returned 0x17cd7a89f80 [0220.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0220.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.496] GetProcessHeap () returned 0x17cd79e0000 [0225.496] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x3e) returned 0x17cd7a82490 [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] GetProcessHeap () returned 0x17cd79e0000 [0225.501] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x3e) returned 0x17cd7a81fe0 [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.505] GetProcessHeap () returned 0x17cd79e0000 [0225.505] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x3e) returned 0x17cd7a825d0 [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] GetProcessHeap () returned 0x17cd79e0000 [0225.508] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x3e) returned 0x17cd7a82990 [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.513] GetProcessHeap () returned 0x17cd79e0000 [0225.513] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4c6a0 [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.515] GetProcessHeap () returned 0x17cd79e0000 [0225.515] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x4e) returned 0x17cd7a89fe0 [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.518] GetProcessHeap () returned 0x17cd79e0000 [0225.518] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4df90 [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] GetProcessHeap () returned 0x17cd79e0000 [0225.521] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x4a) returned 0x17cd7a8a0a0 [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.522] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.523] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] GetProcessHeap () returned 0x17cd79e0000 [0225.524] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4e000 [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.524] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.525] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.526] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.527] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.528] GetProcessHeap () returned 0x17cd79e0000 [0225.528] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x4c) returned 0x17cd7a89da0 [0225.528] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.529] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.530] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.531] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.532] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] GetProcessHeap () returned 0x17cd79e0000 [0225.533] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4d350 [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.533] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.534] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.535] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.536] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.537] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] GetProcessHeap () returned 0x17cd79e0000 [0225.538] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4d430 [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.538] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.539] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.540] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0225.540] GetProcessHeap () returned 0x17cd79e0000 [0225.540] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2c) returned 0x17cd7a87980 [0230.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] GetProcessHeap () returned 0x17cd79e0000 [0230.357] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4d580 [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.359] GetProcessHeap () returned 0x17cd79e0000 [0230.360] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5a) returned 0x17cd7a4c550 [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.361] GetProcessHeap () returned 0x17cd79e0000 [0230.361] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2c) returned 0x17cd7a87180 [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] GetProcessHeap () returned 0x17cd79e0000 [0230.364] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2c) returned 0x17cd7a87d80 [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] GetProcessHeap () returned 0x17cd79e0000 [0230.366] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2c) returned 0x17cd7a87a80 [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] GetProcessHeap () returned 0x17cd79e0000 [0230.368] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x2e) returned 0x17cd7a87840 [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.370] GetProcessHeap () returned 0x17cd79e0000 [0230.370] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x5c) returned 0x17cd7a4d660 [0230.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.373] GetProcessHeap () returned 0x17cd79e0000 [0230.373] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x22) returned 0x17cd7a83cc0 [0230.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.376] GetProcessHeap () returned 0x17cd79e0000 [0230.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x6) returned 0x17cd7a844b0 [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.380] GetProcessHeap () returned 0x17cd79e0000 [0230.380] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x76) returned 0x17cd7a75ac0 [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] GetProcessHeap () returned 0x17cd79e0000 [0230.384] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x18c) returned 0x17cd7a58900 [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.387] GetProcessHeap () returned 0x17cd79e0000 [0230.387] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x8) returned 0x17cd7a84590 [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.390] GetProcessHeap () returned 0x17cd79e0000 [0230.390] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x1e0) returned 0x17cd7a312e0 [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x20, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d948, Length=0x30, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da18, Length=0x30, ResultLength=0x0) [0230.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db50, Length=0x30, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0230.395] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0233.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0233.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0233.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0233.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0233.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x18, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0233.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.860] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.861] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x38, ResultLength=0x0) [0233.861] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0233.861] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.861] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0233.862] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\wwapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffcd5220000 [0233.880] GetProcAddress (hModule=0x7ffcd5220000, lpProcName="WwanOpenHandle") returned 0x7ffcd5221040 [0233.881] GetProcAddress (hModule=0x7ffcd5220000, lpProcName="WwanCloseHandle") returned 0x7ffcd5226170 [0233.881] GetProcAddress (hModule=0x7ffcd5220000, lpProcName="WwanEnumerateInterfaces") returned 0x7ffcd52270e0 [0233.881] GetProcAddress (hModule=0x7ffcd5220000, lpProcName="WwanQueryInterface") returned 0x7ffcd5228e60 [0233.881] GetProcAddress (hModule=0x7ffcd5220000, lpProcName="WwanFreeMemory") returned 0x7ffcd522cbc0 [0233.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0233.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0233.881] WwanOpenHandle () returned 0x426 [0246.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x20, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x18, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da20, Length=0x28, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dac8, Length=0x30, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0246.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.598] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.598] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.598] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.598] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x18, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.600] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x18, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.604] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x18, ResultLength=0x0) [0246.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0246.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.616] GetCurrentHwProfileW (in: lpHwProfileInfo=0x381e17da90 | out: lpHwProfileInfo=0x381e17da90) returned 1 [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x38, ResultLength=0x0) [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0246.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x28, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0247.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x38, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db58, Length=0x38, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.024] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x38, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x30, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0247.025] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x30, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.026] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x38, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8c0, Length=0x30, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x28, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8c0, Length=0x30, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.027] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.028] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] memchr (_Buf=0x17cd7a31310, _Val=0, _MaxCount=0x1af) returned 0x17cd7a31318 [0247.029] memchr (_Buf=0x17cd7a31319, _Val=0, _MaxCount=0x1a6) returned 0x17cd7a31324 [0247.029] memchr (_Buf=0x17cd7a31325, _Val=0, _MaxCount=0x19a) returned 0x17cd7a31331 [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] memchr (_Buf=0x17cd7a3134e, _Val=0, _MaxCount=0x171) returned 0x17cd7a31356 [0247.029] memchr (_Buf=0x17cd7a31357, _Val=0, _MaxCount=0x168) returned 0x17cd7a31360 [0247.029] memchr (_Buf=0x17cd7a31361, _Val=0, _MaxCount=0x15e) returned 0x17cd7a31372 [0247.029] memchr (_Buf=0x17cd7a31373, _Val=0, _MaxCount=0x14c) returned 0x17cd7a3137c [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.029] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] memchr (_Buf=0x17cd7a3138d, _Val=0, _MaxCount=0x132) returned 0x17cd7a31395 [0247.030] memchr (_Buf=0x17cd7a31396, _Val=0, _MaxCount=0x129) returned 0x17cd7a3139e [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.030] memchr (_Buf=0x17cd7a313b6, _Val=0, _MaxCount=0x109) returned 0x17cd7a313be [0247.030] memchr (_Buf=0x17cd7a313bf, _Val=0, _MaxCount=0x100) returned 0x17cd7a313d9 [0247.030] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] memchr (_Buf=0x17cd7a31405, _Val=0, _MaxCount=0xba) returned 0x17cd7a31407 [0247.031] memchr (_Buf=0x17cd7a31408, _Val=0, _MaxCount=0xb7) returned 0x17cd7a31416 [0247.031] memchr (_Buf=0x17cd7a31417, _Val=0, _MaxCount=0xa8) returned 0x17cd7a31441 [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.031] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] memchr (_Buf=0x17cd7a3145a, _Val=0, _MaxCount=0x65) returned 0x17cd7a3145a [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] memchr (_Buf=0x17cd7a31484, _Val=0, _MaxCount=0x3b) returned 0x17cd7a3148a [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.033] memchr (_Buf=0x17cd7a314ab, _Val=0, _MaxCount=0x14) returned 0x17cd7a314ab [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] memchr (_Buf=0x17cd7a314b8, _Val=0, _MaxCount=0x7) returned 0x17cd7a314b8 [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] memchr (_Buf=0x17cd7a314be, _Val=0, _MaxCount=0x1) returned 0x17cd7a314be [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x38, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x38, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dba0, Length=0x28, ResultLength=0x0) [0247.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x20, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db38, Length=0x38, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x30, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x28, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x30, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] memchr (_Buf=0x17cd7a31310, _Val=0, _MaxCount=0x1af) returned 0x17cd7a31318 [0247.040] memchr (_Buf=0x17cd7a31319, _Val=0, _MaxCount=0x1a6) returned 0x17cd7a31324 [0247.040] memchr (_Buf=0x17cd7a31325, _Val=0, _MaxCount=0x19a) returned 0x17cd7a31331 [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.041] memchr (_Buf=0x17cd7a3134e, _Val=0, _MaxCount=0x171) returned 0x17cd7a31356 [0247.042] memchr (_Buf=0x17cd7a31357, _Val=0, _MaxCount=0x168) returned 0x17cd7a31360 [0247.042] memchr (_Buf=0x17cd7a31361, _Val=0, _MaxCount=0x15e) returned 0x17cd7a31372 [0247.042] memchr (_Buf=0x17cd7a31373, _Val=0, _MaxCount=0x14c) returned 0x17cd7a3137c [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] memchr (_Buf=0x17cd7a3138d, _Val=0, _MaxCount=0x132) returned 0x17cd7a31395 [0247.043] memchr (_Buf=0x17cd7a31396, _Val=0, _MaxCount=0x129) returned 0x17cd7a3139e [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x38, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db38, Length=0x38, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0247.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf0, Length=0x20, ResultLength=0x0) [0247.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x20, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da00, Length=0x20, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d990, Length=0x20, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d990, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.864] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.865] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.866] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.876] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0247.888] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.889] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.890] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0247.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0248.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0248.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0248.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3c0, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d370, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d320, Length=0x20, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db50, Length=0x20, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dae0, Length=0x20, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc68, Length=0x30, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dad0, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d880, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x20, ResultLength=0x0) [0248.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dd90, Length=0x28, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.397] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc40, Length=0x20, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc40, Length=0x20, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcd8, Length=0x28, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.398] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.399] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db00, Length=0x20, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db00, Length=0x20, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.400] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbe0, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db80, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db80, Length=0x20, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.401] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.402] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.402] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.402] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.402] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.402] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.403] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.404] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.406] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x48, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.407] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db28, Length=0x48, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da70, Length=0x48, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc50, Length=0x40, ResultLength=0x0) [0248.408] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.409] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.409] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.410] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.411] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.411] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.414] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.414] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.414] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.414] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.414] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.415] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x28, ResultLength=0x0) [0248.852] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.852] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.852] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.852] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.852] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x28, ResultLength=0x0) [0248.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.854] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x28, ResultLength=0x0) [0248.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.855] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x20, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.856] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x20, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.857] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d940, Length=0x50, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.858] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x50, ResultLength=0x0) [0248.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.859] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.862] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x28, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x28, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.863] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x28, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.867] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x28, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x20, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.868] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x20, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.869] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x28, ResultLength=0x0) [0248.870] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.874] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0248.880] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x28, ResultLength=0x0) [0248.882] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x50, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.886] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.887] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.891] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0248.892] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x48, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x48, ResultLength=0x0) [0248.893] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.894] LocalAlloc (uFlags=0x0, uBytes=0x5a) returned 0x17cd7a4d2e0 [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.894] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x20, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x20, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x20, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x20, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.895] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x48, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0248.896] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da38, Length=0x28, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x20, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x20, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da50, Length=0x20, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da80, Length=0x20, ResultLength=0x0) [0248.897] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da20, Length=0x20, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da20, Length=0x20, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.898] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0248.899] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.542] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.542] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.542] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.543] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.544] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.545] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d900, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d910, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c8, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d910, Length=0x48, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.546] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x17cd85e4710 [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daf0, Length=0x40, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.547] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x58, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9b0, Length=0x28, ResultLength=0x0) [0249.553] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x58, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x58, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x58, ResultLength=0x0) [0249.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x28, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x28, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x28, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x28, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x28, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x28, ResultLength=0x0) [0249.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x20, ResultLength=0x0) [0249.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x20, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x38, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x20, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x20, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x20, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x58, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x20, ResultLength=0x0) [0249.573] GetTickCount () returned 0x117eac0 [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d838, Length=0x58, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x38, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x28, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x28, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x28, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x28, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5f0, Length=0x28, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x38, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x28, ResultLength=0x0) [0249.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x28, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x38, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x20, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x38, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x20, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x20, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d838, Length=0x58, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0249.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x28, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x28, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x28, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x28, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5c0, Length=0x28, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0249.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0249.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0249.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x28, ResultLength=0x0) [0250.310] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.310] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.310] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x28, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0250.311] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x20, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.312] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.313] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x38, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x20, ResultLength=0x0) [0250.314] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d838, Length=0x58, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x58, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.315] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.317] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4c0, Length=0x28, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.318] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.320] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.320] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4a0, Length=0x20, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.321] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4a0, Length=0x20, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.322] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x58, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.323] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.325] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4c0, Length=0x28, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.326] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.328] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3e0, Length=0x20, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d360, Length=0x20, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d360, Length=0x20, ResultLength=0x0) [0250.329] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d360, Length=0x20, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4a0, Length=0x20, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.330] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x58, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.331] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d450, Length=0x28, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4c0, Length=0x28, ResultLength=0x0) [0250.333] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d540, Length=0x28, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4a0, Length=0x20, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x20, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x38, ResultLength=0x0) [0250.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4a0, Length=0x20, ResultLength=0x0) [0250.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d430, Length=0x20, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x58, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x28, ResultLength=0x0) [0250.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x28, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x28, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x28, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d490, Length=0x28, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.346] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x28, ResultLength=0x0) [0250.347] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.347] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.347] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.347] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x28, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d380, Length=0x20, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d300, Length=0x20, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d300, Length=0x20, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d300, Length=0x20, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d470, Length=0x20, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d470, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3f0, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x38, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d470, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d400, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d400, Length=0x20, ResultLength=0x0) [0250.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x20, ResultLength=0x0) [0250.353] GetTickCount () returned 0x117edbe [0250.353] GetProcessHeap () returned 0x17cd79e0000 [0250.353] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x18) returned 0x17cd7a8f5e0 [0250.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x30, ResultLength=0x0) [0250.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5b0, Length=0x30, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x38, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x30, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x30, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x30, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x30, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0250.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0251.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.909] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.909] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.909] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.911] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0251.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0252.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d560, Length=0x30, ResultLength=0x0) [0252.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d420, Length=0x18, ResultLength=0x0) [0252.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0252.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0252.382] RegFlushKey (hKey=0x330) returned 0x0 [0253.868] NtLockProductActivationKeys (pPrivateVer=0x0, pSafeMode=0x0) returned 0x0 [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.870] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x38, ResultLength=0x0) [0253.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x30, ResultLength=0x0) [0253.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0253.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.871] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x30, ResultLength=0x0) [0253.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x30, ResultLength=0x0) [0253.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.872] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x28, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x28, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x58, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.873] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.875] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.877] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x28, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x28, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x28, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4b0, Length=0x28, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.878] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d520, Length=0x28, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.879] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x28, ResultLength=0x0) [0253.881] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x28, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.882] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d410, Length=0x20, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d390, Length=0x20, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.883] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d390, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d390, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5e0, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0253.884] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0253.885] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d480, Length=0x20, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x38, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d490, Length=0x20, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d490, Length=0x20, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x40, ResultLength=0x0) [0254.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.061] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.061] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.061] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.061] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.061] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.070] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x40, ResultLength=0x0) [0254.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x40, ResultLength=0x0) [0254.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.087] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.088] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.088] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.088] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.468] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.468] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.468] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.468] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.468] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.469] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.470] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.471] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.471] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.471] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.471] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.472] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.489] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x38, ResultLength=0x0) [0254.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4f0, Length=0x38, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0254.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x40, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.619] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.624] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.625] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.629] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.630] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.636] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0255.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.405] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x40, ResultLength=0x0) [0260.411] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.411] GetFileAttributesW (lpFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak")) returned 0xffffffff [0260.412] GetLastError () returned 0x2 [0260.412] GetFileAttributesW (lpFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp")) returned 0xffffffff [0260.412] GetLastError () returned 0x2 [0260.412] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.412] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x28, ResultLength=0x0) [0260.412] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80000002, hTemplateFile=0x0) returned 0x160 [0260.413] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.413] WriteFile (in: hFile=0x160, lpBuffer=0x17cd7a982f0*, nNumberOfBytesToWrite=0x6c80, lpNumberOfBytesWritten=0x381e17d670, lpOverlapped=0x0 | out: lpBuffer=0x17cd7a982f0*, lpNumberOfBytesWritten=0x381e17d670*=0x6c80, lpOverlapped=0x0) returned 1 [0260.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x28, ResultLength=0x0) [0260.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.475] MoveFileExW (lpExistingFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp"), lpNewFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak"), dwFlags=0x9) returned 1 [0260.477] MoveFileExW (lpExistingFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak"), lpNewFileName="C:\\WINDOWS\\System32\\spp\\store\\2.0\\data.dat" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat"), dwFlags=0x9) returned 1 [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf8, Length=0x50, ResultLength=0x0) [0260.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db70, Length=0x28, ResultLength=0x0) [0260.480] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0260.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf8, Length=0x50, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf8, Length=0x50, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dae0, Length=0x50, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da60, Length=0x28, ResultLength=0x0) [0260.481] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dae0, Length=0x50, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dae0, Length=0x50, ResultLength=0x0) [0260.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dae0, Length=0x50, ResultLength=0x0) [0260.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x38, ResultLength=0x0) [0260.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0260.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x28, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8b0, Length=0x28, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x38, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d930, Length=0x28, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d930, Length=0x28, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x38, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x20, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x38, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x20, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x20, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x20, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d918, Length=0x58, ResultLength=0x0) [0260.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x38, ResultLength=0x0) [0260.495] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x28, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x28, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x28, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x28, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6d0, Length=0x28, ResultLength=0x0) [0260.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x38, ResultLength=0x0) [0260.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0260.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.499] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d750, Length=0x28, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x38, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x20, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x38, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6b0, Length=0x20, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x20, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d640, Length=0x20, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d918, Length=0x58, ResultLength=0x0) [0260.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0260.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x28, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0260.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d590, Length=0x20, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x38, ResultLength=0x0) [0260.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d610, Length=0x20, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d610, Length=0x20, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d918, Length=0x58, ResultLength=0x0) [0260.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x58, ResultLength=0x0) [0260.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0260.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0260.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x28, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.518] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0260.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0260.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0260.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x20, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.475] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x20, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x58, ResultLength=0x0) [0261.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x28, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.479] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0261.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4c0, Length=0x20, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d440, Length=0x20, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d440, Length=0x20, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d440, Length=0x20, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x20, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.484] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x58, ResultLength=0x0) [0261.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.485] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.486] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d530, Length=0x28, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5a0, Length=0x28, ResultLength=0x0) [0261.487] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.488] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.490] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x28, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x20, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x20, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.491] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x38, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d580, Length=0x20, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d510, Length=0x20, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.492] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x58, ResultLength=0x0) [0261.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.493] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.494] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.496] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x28, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x28, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x28, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d500, Length=0x28, ResultLength=0x0) [0261.497] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x28, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.498] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5f0, Length=0x28, ResultLength=0x0) [0261.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.500] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5f0, Length=0x28, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.501] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d460, Length=0x20, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3e0, Length=0x20, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3e0, Length=0x20, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d3e0, Length=0x20, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.502] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.503] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4d0, Length=0x20, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x38, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d550, Length=0x20, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4e0, Length=0x20, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.504] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d4e0, Length=0x20, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.505] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da48, Length=0x50, ResultLength=0x0) [0261.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.506] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x38, ResultLength=0x0) [0261.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.507] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x28, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x28, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x28, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x28, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x28, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.508] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x38, ResultLength=0x0) [0261.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.509] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x28, ResultLength=0x0) [0261.510] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x28, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x38, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x20, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.511] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x38, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x20, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.512] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x20, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.513] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x50, ResultLength=0x0) [0261.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.514] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x38, ResultLength=0x0) [0261.515] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d650, Length=0x28, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d650, Length=0x28, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d650, Length=0x28, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d650, Length=0x28, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.516] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x38, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.517] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x28, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x28, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x38, ResultLength=0x0) [0261.519] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d620, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x38, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.520] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0261.521] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x20, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.334] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0262.334] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d8, Length=0x50, ResultLength=0x0) [0262.335] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.335] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x38, ResultLength=0x0) [0262.336] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d630, Length=0x28, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x28, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x38, ResultLength=0x0) [0262.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0262.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x38, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x38, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0262.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d610, Length=0x20, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d610, Length=0x20, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.342] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.343] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.343] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.343] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.343] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x28, ResultLength=0x0) [0262.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x28, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x20, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.352] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x20, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x20, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x20, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbb0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa0, Length=0x50, ResultLength=0x0) [0262.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d800, Length=0x28, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d870, Length=0x28, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x28, ResultLength=0x0) [0262.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x28, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x38, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x20, ResultLength=0x0) [0262.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x20, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbe0, Length=0x28, ResultLength=0x0) [0262.366] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da30, Length=0x28, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dab0, Length=0x28, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dab0, Length=0x28, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d950, Length=0x20, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x20, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbe0, Length=0x28, ResultLength=0x0) [0262.375] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc60, Length=0x50, ResultLength=0x0) [0262.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x28, ResultLength=0x0) [0262.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.714] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da30, Length=0x28, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.715] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dab0, Length=0x28, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.716] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dab0, Length=0x28, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d950, Length=0x20, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8d0, Length=0x20, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.717] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da10, Length=0x20, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.718] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcb0, Length=0x58, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dc20, Length=0x28, ResultLength=0x0) [0262.719] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcb0, Length=0x58, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcb0, Length=0x58, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcb0, Length=0x58, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.719] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.723] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.723] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.724] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.724] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.724] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0262.724] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.724] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9d0, Length=0x28, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da40, Length=0x28, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.725] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.726] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dac0, Length=0x28, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dac0, Length=0x28, ResultLength=0x0) [0262.727] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d960, Length=0x20, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x20, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x20, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x20, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.728] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db00, Length=0x20, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.729] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x20, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db90, Length=0x38, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17da20, Length=0x20, ResultLength=0x0) [0262.730] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9b0, Length=0x20, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9b0, Length=0x20, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dcb0, Length=0x58, ResultLength=0x0) [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf0, Length=0x20, ResultLength=0x0) [0262.731] GetTickCount () returned 0x1181e24 [0262.731] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa8, Length=0x58, ResultLength=0x0) [0262.732] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.732] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x38, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x28, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x28, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x28, ResultLength=0x0) [0262.734] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7f0, Length=0x28, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d860, Length=0x28, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x38, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.735] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x28, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x28, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.738] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x38, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x20, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x20, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x20, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x20, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.739] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9c0, Length=0x38, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x20, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x20, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.740] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.741] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.741] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.741] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa8, Length=0x58, ResultLength=0x0) [0262.741] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.741] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.743] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.743] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.746] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.746] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x28, ResultLength=0x0) [0262.747] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d830, Length=0x28, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.748] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8b0, Length=0x28, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8b0, Length=0x28, ResultLength=0x0) [0262.751] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.752] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x20, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8f0, Length=0x20, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.753] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.754] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x20, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0262.755] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d980, Length=0x38, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x20, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7a0, Length=0x20, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.553] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17daa8, Length=0x58, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x58, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.554] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x28, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x20, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x20, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x58, ResultLength=0x0) [0263.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x28, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d650, Length=0x20, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x20, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x20, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5d0, Length=0x20, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x20, ResultLength=0x0) [0263.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x58, ResultLength=0x0) [0263.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6c0, Length=0x28, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d730, Length=0x28, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7b0, Length=0x28, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x20, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x20, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d890, Length=0x38, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d710, Length=0x20, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6a0, Length=0x20, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d970, Length=0x58, ResultLength=0x0) [0263.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x28, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x28, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x28, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x28, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x28, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x28, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.591] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d780, Length=0x28, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.592] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d5f0, Length=0x20, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0263.593] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d570, Length=0x20, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7c0, Length=0x20, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6e0, Length=0x20, ResultLength=0x0) [0263.594] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6e0, Length=0x20, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.595] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d660, Length=0x20, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x38, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6e0, Length=0x20, ResultLength=0x0) [0263.596] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x20, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d670, Length=0x20, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.597] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0263.598] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17dbf0, Length=0x20, ResultLength=0x0) [0263.599] GetTickCount () returned 0x1182180 [0263.599] GetProcessHeap () returned 0x17cd79e0000 [0263.599] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x18) returned 0x17cd7a8fa20 [0263.599] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9a0, Length=0x30, ResultLength=0x0) [0264.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0264.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0264.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d820, Length=0x30, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x38, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x30, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.385] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x30, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x20, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x30, ResultLength=0x0) [0264.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x30, ResultLength=0x0) [0264.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0264.389] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0265.179] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.179] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.180] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.180] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.180] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.180] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.180] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.181] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.181] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.181] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.181] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.181] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.182] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.183] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.184] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.185] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.186] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.186] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.186] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7d0, Length=0x30, ResultLength=0x0) [0265.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d690, Length=0x18, ResultLength=0x0) [0265.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0265.557] RegFlushKey (hKey=0x160) returned 0x0 [0266.904] NtLockProductActivationKeys (pPrivateVer=0x0, pSafeMode=0x0) returned 0x0 [0266.905] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.905] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8a0, Length=0x38, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x30, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d740, Length=0x20, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.906] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.907] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d7e0, Length=0x30, ResultLength=0x0) [0266.907] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x30, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db10, Length=0x28, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17db10, Length=0x28, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d9f0, Length=0x58, ResultLength=0x0) [0266.908] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.909] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.910] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.912] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0266.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.913] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d720, Length=0x28, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d790, Length=0x28, ResultLength=0x0) [0266.914] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.915] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x28, ResultLength=0x0) [0266.917] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.917] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.917] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d810, Length=0x28, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.918] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.919] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.919] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.919] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.919] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d680, Length=0x20, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d600, Length=0x20, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d850, Length=0x20, ResultLength=0x0) [0266.920] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.921] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d6f0, Length=0x20, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d8e0, Length=0x38, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d770, Length=0x20, ResultLength=0x0) [0266.922] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x20, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d700, Length=0x20, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.923] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.924] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.924] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.925] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.925] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.925] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.925] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.926] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.927] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.927] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.927] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.927] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.927] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.928] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.929] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.929] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.929] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.929] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.930] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.931] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.931] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.931] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.931] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.931] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.932] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.933] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.933] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.933] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.933] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.933] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.934] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.934] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.934] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.935] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.936] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.937] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.937] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.937] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.937] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.938] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.939] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.940] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.941] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.941] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.941] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.941] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.942] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.943] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.944] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.945] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.945] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.945] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.945] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.946] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.946] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.946] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.946] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.946] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.947] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.947] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0266.947] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.947] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.947] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.948] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0266.949] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x40, ResultLength=0x0) [0267.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x40, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0267.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0267.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0267.590] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.612] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d840, Length=0x38, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.615] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.616] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d760, Length=0x38, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17d920, Length=0x40, ResultLength=0x0) [0268.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.637] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.638] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.639] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.640] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.641] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.642] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.643] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.644] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.645] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.646] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.647] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.648] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.649] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.650] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.651] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.652] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0268.653] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.657] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.658] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.659] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.660] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.661] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.662] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.663] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.664] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.665] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.666] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.667] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.668] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.669] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.670] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.671] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.672] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.673] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.674] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.675] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.676] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.677] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.678] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.679] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.680] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.681] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.682] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.683] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.684] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.685] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.686] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.687] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.688] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.689] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0269.690] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.470] GetProcessHeap () returned 0x17cd79e0000 [0298.470] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c75f00 [0298.470] GetProcessHeap () returned 0x17cd79e0000 [0298.470] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5a20 [0298.470] GetProcessHeap () returned 0x17cd79e0000 [0298.470] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x12c) returned 0x17cd86bee60 [0298.470] GetProcessHeap () returned 0x17cd79e0000 [0298.470] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x138) returned 0x17cd88be4c0 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x140) returned 0x17cd8ca49d0 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x30) returned 0x17cd8bacf40 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x140) returned 0x17cd8ca4730 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c77ea0 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5ca0 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd8ca49d0 | out: hHeap=0x17cd79e0000) returned 1 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x1f4) returned 0x17cd7a92640 [0298.471] GetProcessHeap () returned 0x17cd79e0000 [0298.471] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xf4) returned 0x17cd85f5a60 [0298.471] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17ed48 | out: phModule=0x381e17ed48*=0x7ffcea380000) returned 1 [0298.471] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.472] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17ee28 | out: phModule=0x381e17ee28*=0x7ffcea380000) returned 1 [0298.472] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea40, Length=0x50, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea40, Length=0x50, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea40, Length=0x50, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e930, Length=0x50, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.473] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e930, Length=0x50, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e930, Length=0x50, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e930, Length=0x50, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.474] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x38, ResultLength=0x0) [0298.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x28, ResultLength=0x0) [0298.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.476] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x28, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x28, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x28, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.477] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e700, Length=0x28, ResultLength=0x0) [0298.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x38, ResultLength=0x0) [0298.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.478] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e780, Length=0x28, ResultLength=0x0) [0298.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.480] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e780, Length=0x28, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e620, Length=0x20, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5a0, Length=0x20, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5a0, Length=0x20, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.481] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5a0, Length=0x20, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x38, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x38, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e6e0, Length=0x20, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e670, Length=0x20, ResultLength=0x0) [0298.482] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e670, Length=0x20, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.483] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0298.485] GetProcessHeap () returned 0x17cd79e0000 [0298.485] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c763d0 [0298.485] GetProcessHeap () returned 0x17cd79e0000 [0298.485] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5a60 [0298.485] GetProcessHeap () returned 0x17cd79e0000 [0298.485] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x11c) returned 0x17cd79f07a0 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x128) returned 0x17cd79f0080 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x30) returned 0x17cd8bacf40 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x130) returned 0x17cd88be4c0 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c779d0 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba59d0 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd86bee60 | out: hHeap=0x17cd79e0000) returned 1 [0298.487] GetProcessHeap () returned 0x17cd79e0000 [0298.487] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x1e4) returned 0x17cd7a92640 [0298.488] GetProcessHeap () returned 0x17cd79e0000 [0298.488] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x104) returned 0x17cd7a3e310 [0298.488] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17ed78 | out: phModule=0x381e17ed78*=0x7ffcea380000) returned 1 [0298.488] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.489] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17ed78 | out: phModule=0x381e17ed78*=0x7ffcea380000) returned 1 [0298.489] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.729] GetProcessHeap () returned 0x17cd79e0000 [0298.729] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c770e0 [0298.729] GetProcessHeap () returned 0x17cd79e0000 [0298.729] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5bf0 [0298.729] GetProcessHeap () returned 0x17cd79e0000 [0298.729] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xfe) returned 0x17cd7a3dcb0 [0298.730] GetProcessHeap () returned 0x17cd79e0000 [0298.730] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x108) returned 0x17cd7a3f740 [0298.730] GetProcessHeap () returned 0x17cd79e0000 [0298.730] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x30) returned 0x17cd8bad380 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x110) returned 0x17cd8b15f20 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c763d0 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5d10 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd8b15500 | out: hHeap=0x17cd79e0000) returned 1 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x1c4) returned 0x17cd8cf0710 [0298.731] GetProcessHeap () returned 0x17cd79e0000 [0298.731] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xfc) returned 0x17cd7a3f850 [0298.731] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17edf8 | out: phModule=0x381e17edf8*=0x7ffcea380000) returned 1 [0298.732] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.734] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17ef20 | out: phModule=0x381e17ef20*=0x7ffcea380000) returned 1 [0298.734] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0298.738] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17efa0 | out: phModule=0x381e17efa0*=0x7ffcea380000) returned 1 [0298.738] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0299.055] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) [0299.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea60, Length=0x50, ResultLength=0x0) [0299.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea60, Length=0x50, ResultLength=0x0) [0299.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.055] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea60, Length=0x50, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e950, Length=0x50, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e950, Length=0x50, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e950, Length=0x50, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e950, Length=0x50, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.056] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x38, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e6b0, Length=0x28, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e6b0, Length=0x28, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e6b0, Length=0x28, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.059] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e6b0, Length=0x28, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e720, Length=0x28, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x38, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.060] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7a0, Length=0x28, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7a0, Length=0x28, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e640, Length=0x20, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5c0, Length=0x20, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5c0, Length=0x20, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e5c0, Length=0x20, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x38, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x38, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e700, Length=0x20, ResultLength=0x0) [0299.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x20, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e690, Length=0x20, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.065] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x28, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.072] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e900, Length=0x28, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e900, Length=0x28, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x20, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x20, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7f0, Length=0x20, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7f0, Length=0x20, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebc0, Length=0x50, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eab0, Length=0x50, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e810, Length=0x28, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e880, Length=0x28, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e900, Length=0x28, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e900, Length=0x28, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.337] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x20, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7e0, Length=0x20, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9e0, Length=0x38, ResultLength=0x0) [0299.338] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e860, Length=0x20, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7f0, Length=0x20, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e7f0, Length=0x20, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.339] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebf0, Length=0x28, ResultLength=0x0) [0299.340] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.340] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.341] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.344] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea40, Length=0x28, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.345] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eac0, Length=0x28, ResultLength=0x0) [0299.347] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.348] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eac0, Length=0x28, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea20, Length=0x20, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.349] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea20, Length=0x20, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9b0, Length=0x20, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9b0, Length=0x20, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.350] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.351] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ebf0, Length=0x28, ResultLength=0x0) [0299.362] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ec70, Length=0x50, ResultLength=0x0) [0299.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.363] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9d0, Length=0x28, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea40, Length=0x28, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eac0, Length=0x28, ResultLength=0x0) [0299.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eac0, Length=0x28, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea20, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9a0, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17eba0, Length=0x38, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17ea20, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9b0, Length=0x20, ResultLength=0x0) [0299.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e17e9b0, Length=0x20, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0299.374] GetProcessHeap () returned 0x17cd79e0000 [0299.374] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c76b60 [0299.374] GetProcessHeap () returned 0x17cd79e0000 [0299.374] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5c70 [0299.374] GetProcessHeap () returned 0x17cd79e0000 [0299.374] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xfe) returned 0x17cd7a3eec0 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x108) returned 0x17cd7a3dba0 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x30) returned 0x17cd8bacc80 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x110) returned 0x17cd7a932f0 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xa0) returned 0x17cd8c78420 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x8) returned 0x17cd8ba5af0 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] HeapFree (in: hHeap=0x17cd79e0000, dwFlags=0x0, lpMem=0x17cd7a92d50 | out: hHeap=0x17cd79e0000) returned 1 [0299.376] GetProcessHeap () returned 0x17cd79e0000 [0299.376] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0x1c4) returned 0x17cd7a45c00 [0299.377] GetProcessHeap () returned 0x17cd79e0000 [0299.377] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x8, Size=0xfc) returned 0x17cd7a3dfe0 [0299.377] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x381e17edf8 | out: phModule=0x381e17edf8*=0x7ffcea380000) returned 1 [0299.377] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQuerySystemInformation") returned 0x7ffcea425a50 [0299.684] RegCreateKeyExW (hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x8000000000020019, lpSecurityAttributes=0x0, phkResult=0x381e17f1d0, lpdwDisposition=0x381e17f270) Thread: id = 634 os_tid = 0x1138 Thread: id = 635 os_tid = 0x1128 Thread: id = 640 os_tid = 0xea4 [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff2c0, Length=0x28, ResultLength=0x0) [0294.353] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.353] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.354] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.355] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff110, Length=0x28, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.356] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.357] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff190, Length=0x28, ResultLength=0x0) [0294.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.358] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff190, Length=0x28, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0f0, Length=0x20, ResultLength=0x0) [0294.359] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0f0, Length=0x20, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.360] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.361] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff2c0, Length=0x28, ResultLength=0x0) [0294.361] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff340, Length=0x50, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.362] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.364] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x28, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff110, Length=0x28, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.365] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.366] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff190, Length=0x28, ResultLength=0x0) [0294.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.367] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff190, Length=0x28, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.368] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0f0, Length=0x20, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff070, Length=0x20, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.369] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0f0, Length=0x20, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.370] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff390, Length=0x58, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff300, Length=0x28, ResultLength=0x0) [0294.371] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff390, Length=0x58, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff390, Length=0x58, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.371] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff390, Length=0x58, ResultLength=0x0) [0294.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.372] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.373] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.374] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0b0, Length=0x28, ResultLength=0x0) [0294.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.375] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0b0, Length=0x28, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0b0, Length=0x28, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff120, Length=0x28, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.376] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.377] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff1a0, Length=0x28, ResultLength=0x0) [0294.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.378] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff1a0, Length=0x28, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.379] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff010, Length=0x20, ResultLength=0x0) [0294.380] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef90, Length=0x20, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef90, Length=0x20, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef90, Length=0x20, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff1e0, Length=0x20, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.381] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff100, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff100, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.382] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff080, Length=0x20, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff270, Length=0x38, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff100, Length=0x20, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff090, Length=0x20, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.383] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff090, Length=0x20, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff390, Length=0x58, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff2d0, Length=0x20, ResultLength=0x0) [0294.384] GetTickCount () returned 0x11899cd [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff188, Length=0x58, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.384] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x38, ResultLength=0x0) [0294.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feed0, Length=0x28, ResultLength=0x0) [0294.386] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feed0, Length=0x28, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feed0, Length=0x28, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feed0, Length=0x28, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.387] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef40, Length=0x28, ResultLength=0x0) [0294.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x38, ResultLength=0x0) [0294.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.388] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x28, ResultLength=0x0) [0294.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.390] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x28, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x38, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x20, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x20, ResultLength=0x0) [0294.391] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x20, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x20, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0a0, Length=0x38, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x20, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feeb0, Length=0x20, ResultLength=0x0) [0294.392] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feeb0, Length=0x20, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.393] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff188, Length=0x58, ResultLength=0x0) [0294.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.394] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.396] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.396] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.601] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x28, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x28, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x28, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x28, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.602] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef10, Length=0x28, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.603] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef90, Length=0x28, ResultLength=0x0) [0294.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.605] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef90, Length=0x28, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.606] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee00, Length=0x20, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.607] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefd0, Length=0x20, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feef0, Length=0x20, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.608] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feef0, Length=0x20, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x20, ResultLength=0x0) [0294.609] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff060, Length=0x38, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feef0, Length=0x20, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee80, Length=0x20, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.610] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee80, Length=0x20, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff188, Length=0x58, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff050, Length=0x58, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.611] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.613] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee10, Length=0x28, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.614] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0294.617] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.618] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.620] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedf0, Length=0x20, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.621] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedf0, Length=0x20, ResultLength=0x0) [0294.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.622] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff050, Length=0x58, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.623] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.626] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee10, Length=0x28, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.627] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.628] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0294.631] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.632] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed30, Length=0x20, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fecb0, Length=0x20, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fecb0, Length=0x20, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fecb0, Length=0x20, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.633] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedf0, Length=0x20, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.634] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff050, Length=0x58, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0294.635] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0295.062] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feda0, Length=0x28, ResultLength=0x0) [0295.063] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee10, Length=0x28, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.064] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0295.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.066] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee90, Length=0x28, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedf0, Length=0x20, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x20, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.067] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef70, Length=0x38, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedf0, Length=0x20, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed80, Length=0x20, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.068] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff050, Length=0x58, ResultLength=0x0) [0295.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.069] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.071] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x28, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x28, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.073] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x28, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed70, Length=0x28, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fede0, Length=0x28, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.074] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.075] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee60, Length=0x28, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee60, Length=0x28, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fecd0, Length=0x20, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fec50, Length=0x20, ResultLength=0x0) [0295.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fec50, Length=0x20, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fec50, Length=0x20, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feea0, Length=0x20, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedc0, Length=0x20, ResultLength=0x0) [0295.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedc0, Length=0x20, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed40, Length=0x20, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x38, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedc0, Length=0x20, ResultLength=0x0) [0295.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed50, Length=0x20, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed50, Length=0x20, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff2d0, Length=0x20, ResultLength=0x0) [0295.083] GetTickCount () returned 0x1189c7c [0295.083] GetProcessHeap () returned 0x17cd79e0000 [0295.083] RtlAllocateHeap (HeapHandle=0x17cd79e0000, Flags=0x0, Size=0x18) returned 0x17cd8b8fb30 [0295.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff1f0, Length=0x28, ResultLength=0x0) [0295.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff1f0, Length=0x28, ResultLength=0x0) [0295.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff0d0, Length=0x58, ResultLength=0x0) [0295.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.086] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.088] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee00, Length=0x28, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee00, Length=0x28, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee00, Length=0x28, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.089] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee00, Length=0x28, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee70, Length=0x28, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feef0, Length=0x28, ResultLength=0x0) [0295.092] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.092] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.093] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.093] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3feef0, Length=0x28, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fed60, Length=0x20, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fece0, Length=0x20, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fece0, Length=0x20, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fece0, Length=0x20, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef30, Length=0x20, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee50, Length=0x20, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee50, Length=0x20, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fedd0, Length=0x20, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fefc0, Length=0x38, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee50, Length=0x20, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fede0, Length=0x20, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fede0, Length=0x20, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff000, Length=0x40, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0295.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.102] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.102] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.102] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.102] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.102] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.103] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.103] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0295.103] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.103] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.103] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.104] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.105] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.106] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.107] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0295.108] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.108] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.108] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0295.108] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0295.108] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.039] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.040] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.041] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.042] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.043] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.044] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.045] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.046] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.047] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.048] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.049] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.050] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.051] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.052] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.053] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.054] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.076] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.077] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.078] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.079] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.080] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.081] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.082] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.083] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.084] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.085] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.090] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.091] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.091] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.091] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.091] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.092] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.092] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.092] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.093] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.093] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.093] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.094] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff000, Length=0x40, ResultLength=0x0) [0296.095] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff000, Length=0x40, ResultLength=0x0) [0296.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.096] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.097] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.098] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.099] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.100] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.101] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.555] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.556] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.557] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.558] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.559] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.560] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.561] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.562] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.563] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.564] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.565] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.566] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.567] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.568] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.569] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.570] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.571] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.572] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.573] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.574] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.575] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.576] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.577] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.578] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.579] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.580] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.581] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.582] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.583] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fef20, Length=0x38, ResultLength=0x0) [0296.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.584] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.585] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.586] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.587] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3fee40, Length=0x38, ResultLength=0x0) [0296.588] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.589] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x381e3ff000, Length=0x40, ResultLength=0x0) [0296.767] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.767] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.767] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.767] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.768] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.768] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.768] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.768] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.769] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.770] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.770] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.770] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.770] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.770] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.771] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.771] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.771] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.771] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.771] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.772] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.773] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.773] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0296.773] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.012] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.013] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.014] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.015] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.016] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.017] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.018] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.019] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.020] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.021] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.022] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.023] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.032] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.033] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.034] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.035] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.036] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.037] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.038] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.149] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.150] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.150] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.150] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.150] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.150] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.151] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.152] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.153] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.154] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.155] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.156] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.157] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.158] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.159] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.160] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.160] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) [0297.160] NtQuerySystemInformation (SystemInformationClass=0xb9, SystemInformation=0x0, Length=0x0, ResultLength=0x0) Process: id = "43" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xb3b0000" os_pid = "0x1150" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0008de0f" [0xc000000f] Thread: id = 642 os_tid = 0x134 Thread: id = 643 os_tid = 0xd7c Thread: id = 644 os_tid = 0x704 Thread: id = 645 os_tid = 0x11bc Thread: id = 646 os_tid = 0x384 Thread: id = 647 os_tid = 0x1254 Thread: id = 648 os_tid = 0x12e8 Thread: id = 649 os_tid = 0x3b8 Thread: id = 650 os_tid = 0x824 Process: id = "44" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0xbddd000" os_pid = "0x13e0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 654 os_tid = 0xce0 Thread: id = 655 os_tid = 0x13e8 Process: id = "45" image_name = "buiransomsample.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\buiransomsample.exe" page_root = "0x34ede000" os_pid = "0x1114" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3ac" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\BUIRansomSample.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 656 os_tid = 0x125c